To set up an Ethernet-connected computer as a gateway, you must enable IP forwarding to allow traffic routing between network interfaces and configure Network Address Translation (NAT) via iptables or nftables. This setup transforms your machine into a router, enabling other devices on the local subnet to access external networks through it. The process involves adjusting kernel parameters, defining firewall rules for masquerading, and ensuring the DHCP server correctly assigns the gateway address to clients.
Prerequisites and Hardware Setup
Before configuring software, ensure your hardware is physically connected correctly. You typically need two network interfaces: one facing the upstream internet source (WAN) and one facing the local client devices (LAN). For example, if using a Raspberry Pi, connect the WAN port to your modem or primary router via Ethernet, and connect the LAN port to a switch or directly to client devices.
It is crucial that the operating system recognizes both interfaces. Verify connectivity by pinging the upstream gateway from the WAN interface. If you are following steps similar to
connecting dev-board to internet via Ethernet cable connection to host pc, ensure that the physical link lights are active on both ports. A common mistake is assigning the same subnet mask to both interfaces, which can cause routing conflicts. Ensure your LAN subnet (e.g., 192.168.1.x) does not overlap with the WAN subnet provided by your ISP.
Enabling IP Forwarding
The Linux kernel blocks packet forwarding by default for security reasons. To allow your computer to route packets between the WAN and LAN interfaces, you must enable IP forwarding. This is a temporary setting that resets upon reboot unless made permanent.
First, check the current status of IP forwarding by reading the sysctl parameter:
cat /proc/sys/net/ipv4/ip_forward
If the output is
0, forwarding is disabled. Enable it temporarily for the current session using the following command:
sudo sysctl net.ipv4.ip_forward=1
To make this change persistent across reboots, edit the
/etc/sysctl.conf file or create a custom configuration file in
/etc/sysctl.d/. Add or uncomment the following line:
net.ipv4.ip_forward = 1
Apply the changes immediately without rebooting by running:
sudo sysctl -p
Verify that the value is now
1. Without this step, even correct firewall rules will fail because the kernel will drop routed packets before they reach the networking stack.
Configuring NAT with iptables
Network Address Translation (NAT) allows multiple devices on your LAN to share a single public IP address assigned to the WAN interface. The most common method is Source NAT (SNAT), often referred to as "masquerading" in iptables.
Assuming your WAN interface is
eth0 and your LAN interface is
eth1, you need to add a rule to the POSTROUTING chain of the nat table. This rule modifies the source IP address of outgoing packets from the LAN to match the WAN interface's IP address.
Execute the following command:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
This command tells the kernel: "For any packet leaving through
eth0, replace its source IP with the IP currently assigned to
eth0." It also handles dynamic IP addresses gracefully; if your WAN IP changes (common with DHCP connections), the masquerade rule updates automatically.
You must also ensure that the FORWARD chain allows traffic to pass through the filter table. By default, many distributions drop forwarded traffic. Allow established connections and new traffic originating from the LAN:
sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
Save these rules so they survive a reboot. On Debian-based systems, you can use
iptables-persistent:
sudo apt install iptables-persistent
sudo netfilter-persistent save
On Red Hat-based systems, use
firewalld or
iptables-services depending on your distribution version. If you recently dealt with
flashed a wrong network mask in a PoE device, double-check that your interface configurations do not conflict with these NAT rules.
DHCP Configuration for Clients
Client devices need to know which IP address to use as their default gateway. While you could manually configure each device, installing a DHCP server like
dnsmasq or
isc-dhcp-server automates this process.
Using
dnsmasq is simpler for small setups. Install it via your package manager:
sudo apt install dnsmasq
Edit the configuration file at
/etc/dnsmasq.conf. Set the interface for the DHCP service to your LAN interface (
eth1), define the range of IP addresses to hand out, and specify the gateway and DNS servers.
interface=eth1
dhcp-range=192.168.1.50,192.168.1.150,12h
dhcp-option=option:router,192.168.1.1
dhcp-option=option:dns-server,8.8.8.8,8.8.4.4
In this example, the gateway is set to
192.168.1.1, which should be the IP address of your LAN interface (
eth1). Restart the service to apply changes:
sudo systemctl restart dnsmasq
Ensure that your LAN interface has a static IP address within the specified subnet. For instance, assign
192.168.1.1/24 to
eth1 in your network configuration files (such as
/etc/network/interfaces or Netplan/YAML configs).
Testing and Troubleshooting
Once configured, connect a client device to the LAN port. It should receive an IP address, gateway, and DNS server automatically. Test internet connectivity by pinging an external IP address, such as
8.8.8.8. If ping works but web browsing fails, check your DNS settings.
If clients cannot connect, verify the following:
- IP Forwarding: Confirm
cat /proc/sys/net/ipv4/ip_forward returns 1.
- Firewall Rules: Check
sudo iptables -L -v -n to ensure MASQUERADE and FORWARD rules are present and counting packets.
- Interface Names: Ensure
eth0 and eth1 correspond to the correct physical ports. Use ip addr show to identify them.
- Routing Table: Run
ip route to ensure there is a default route pointing to the upstream gateway on the WAN interface.
If you encounter issues where the LAN adapter is not functioning properly, refer to guides on
LAN adapter not working on HP laptops for general troubleshooting steps that may apply to driver or hardware recognition issues.
Frequently Asked Questions
Why can't my devices access the internet after enabling IP forwarding?
The most likely cause is missing NAT rules. IP forwarding only routes packets; it does not translate private IP addresses to public ones. Ensure you have added the MASQUERADE rule to the POSTROUTING chain of the nat table. Without NAT, the upstream router will drop packets coming from private IP ranges.
How do I handle dynamic WAN IP addresses?
Use the MASQUERADE target instead of SNAT (MASQUERADE is essentially SNAT with dynamic IP support). When you use
-j MASQUERADE, iptables queries the current IP of the outbound interface for each packet, making it ideal for DHCP-assigned WAN connections. Static SNAT requires knowing the IP in advance.
Can I use this setup for VPN passthrough?
Yes, but you must adjust your firewall rules to allow VPN traffic. Standard NAT might interfere with encrypted tunnels if not configured correctly. You may need to exclude specific subnets from NAT or ensure your VPN client on the gateway routes traffic appropriately. Refer to documentation on
sharing internet connection over RJ45 to modem for related sharing scenarios.
What happens if the gateway computer reboots?
If you did not persist the IP forwarding setting and firewall rules, the gateway functionality will be lost until you manually re-enable them. Always save iptables rules using a persistence tool and set
net.ipv4.ip_forward=1 in
/etc/sysctl.conf to ensure automatic recovery.
Is it safe to expose this computer to the internet?
Only if you strictly limit forwarded traffic. By default, the FORWARD chain should drop incoming traffic from the WAN to the LAN unless explicitly allowed. Avoid opening unnecessary ports. Treat the gateway as a hardened router, disabling unused services and keeping the OS updated to minimize attack surfaces.