I'm following this helpful guideline on using a Pi as a router. I have a Pi 3 with Jessie Lite.
The AP function is working well, but the NAT routing does not work. Any devices connected to the LAN (AP side on wlan0) are able to ping the Pi's IP address on that interface, and connect to the Pi via SSH. But they cannot forward packets to the Internet connected (WAN) interface (eth0).
I have un-commented net.ipv4.ip_forward=1 in /etc/sysctl.conf
The article has these three commands for iptables:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
I can enter these from the shell and there are no errors. When I list the iptables afterwards, I see this:
pi@raspberrypi3:~ $ sudo iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -A POSTROUTING -o eth0 -j MASQUERADE pi@raspberrypi3:~ $ sudo iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i wlan0 -o eth0 -j ACCEPT pi@raspberrypi3:~ $
The Pi is able to reach the Internet over eth0:
pi@raspberrypi3:~ $ ping 188.8.131.52 PING 184.108.40.206 (220.127.116.11) 56(84) bytes of data. 64 bytes from 18.104.22.168: icmp_seq=1 ttl=57 time=57.8 ms 64 bytes from 22.214.171.124: icmp_seq=2 ttl=57 time=39.4 ms 64 bytes from 126.96.36.199: icmp_seq=3 ttl=57 time=39.2 ms 64 bytes from 188.8.131.52: icmp_seq=4 ttl=57 time=53.9 ms
What am I missing to enable NAT routing?
/etc/network/interfaces looks like this:
pi@raspberrypi3:~ $ cat /etc/network/interfaces # interfaces(5) file used by ifup(8) and ifdown(8) # Please note that this file is written to be used with dhcpcd # For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf' # Include files from /etc/network/interfaces.d: source-directory /etc/network/interfaces.d auto lo iface lo inet loopback iface eth0 inet dhcp allow-hotplug wlan0 iface wlan0 inet static address 192.168.11.1 netmask 255.255.255.0 network 192.168.11.0 broadcast 192.168.11.255
Per the original article, I solved the dhcpcd problem by adding
to the bottom of /etc/dhcpcd.conf