2

I'm following this helpful guideline on using a Pi as a router. I have a Pi 3 with Jessie Lite.

The AP function is working well, but the NAT routing does not work. Any devices connected to the LAN (AP side on wlan0) are able to ping the Pi's IP address on that interface, and connect to the Pi via SSH. But they cannot forward packets to the Internet connected (WAN) interface (eth0).

I have un-commented net.ipv4.ip_forward=1 in /etc/sysctl.conf

The article has these three commands for iptables:

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE  
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT  
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT 

I can enter these from the shell and there are no errors. When I list the iptables afterwards, I see this:

pi@raspberrypi3:~ $ sudo iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-A POSTROUTING -o eth0 -j MASQUERADE
pi@raspberrypi3:~ $ sudo iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT
pi@raspberrypi3:~ $

The Pi is able to reach the Internet over eth0:

pi@raspberrypi3:~ $ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=57.8 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=57 time=39.4 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=57 time=39.2 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=57 time=53.9 ms

What am I missing to enable NAT routing?

/etc/network/interfaces looks like this:

pi@raspberrypi3:~ $ cat /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

iface eth0 inet dhcp

allow-hotplug wlan0
iface wlan0 inet static
    address 192.168.11.1
    netmask 255.255.255.0
    network 192.168.11.0
    broadcast 192.168.11.255

Per the original article, I solved the dhcpcd problem by adding

denyinterfaces wlan0  

to the bottom of /etc/dhcpcd.conf

  • After further investigation, this is a problem with the routing table. I have another interface for management (my SSH connection), and the iptables and route metrics are out of sync. Now I'm studying how to set route metrics. – tim11g Jan 8 '17 at 16:01
  • @tim11g did you resolve this issue? I think I have same problem: raspberrypi.stackexchange.com/questions/70335/… – user66638 Jul 26 '17 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.