Allowing a Device Access to the Internet through UFW on Raspberry Pi

To allow a connected device to access the Internet through UFW on a Raspberry Pi, you must enable IP forwarding and configure NAT masquerading. This setup turns your Pi into a gateway, routing traffic from the Ethernet interface to the Wi-Fi connection while the firewall remains active.

Prerequisites for Connection Sharing

Before configuring the firewall, ensure your Raspberry Pi is successfully connected to the Internet via Wi-Fi. The goal is to share this wireless connection with another device plugged into the Pi's Ethernet port. You need to know the names of both network interfaces. Run ip a or ifconfig to identify them. Typically, the Wi-Fi interface is named wlan0 and the Ethernet interface is eth0. Verify that the Ethernet port has an IP address assigned, usually via DHCP from the client device or manually configured in the same subnet.

Enabling IP Forwarding

The Linux kernel must be instructed to pass packets between network interfaces. By default, this feature is disabled for security reasons. To enable it temporarily for testing, use the following command:

sudo sysctl -w net.ipv4.ip_forward=1

To make this change persistent across reboots, edit the configuration file. Open /etc/sysctl.conf with a text editor like nano:

sudo nano /etc/sysctl.conf

Find the line containing net.ipv4.ip_forward. If it is commented out with a hash (#), remove the hash. If the line does not exist, add it. Set the value to 1:

net.ipv4.ip_forward=1

Save the file and exit the editor. Apply the changes immediately by running:

sudo sysctl -p

You can verify that forwarding is enabled by checking the output of cat /proc/sys/net/ipv4/ip_forward, which should return 1.

Configuring NAT with iptables

Network Address Translation (NAT) allows devices on your local Ethernet network to use the Pi's public IP address when accessing the Internet. This is often referred to as "masquerading." You need to tell the firewall to rewrite the source IP of outgoing packets from the Ethernet side. Run the following command to set up the masquerade rule:

sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

This command tells the NAT table to masquerade all traffic leaving through wlan0. It assumes your Wi-Fi interface is wlan0. If your interface name differs, replace wlan0 with the correct name. This rule ensures that when a packet comes from eth0 and leaves via Wi-Fi, its source address is changed to the Pi's external IP. To ensure these rules survive a reboot, you should install a package that saves and restores iptables rules. A common choice is iptables-persistent:

sudo apt update
sudo apt install iptables-persistent
sudo netfilter-persistent save

This step is crucial because standard UFW configurations do not automatically handle NAT rules in the NAT table. Without saving these rules, your shared connection will break after a restart.

Setting Up UFW Rules

UFW (Uncomplicated Firewall) manages the filter table, which controls incoming and outgoing connections. For connection sharing to work, you must allow forwarding between the interfaces. First, ensure UFW is installed and enabled:

sudo ufw enable

Next, allow forwarding specifically between your Ethernet and Wi-Fi interfaces. Replace eth0 and wlan0 with your actual interface names if they differ:

sudo ufw route allow in on eth0 out on wlan0

This rule permits packets to move from the Ethernet interface to the Wi-Fi interface. You may also want to allow reverse traffic if the client needs to initiate connections back to the Pi, though typically only outbound Internet access is required for simple sharing:

sudo ufw route allow in on wlan0 out on eth0

Check the status of your routes with:

sudo ufw status verbose

Look for lines indicating "ALLOW IN" and "ALLOW OUT" between your interfaces. If the status shows "inactive," UFW is not running correctly.

Testing the Connection

Connect your client device to the Raspberry Pi using an Ethernet cable. Configure the client to obtain an IP address automatically via DHCP. If your Pi is not acting as a DHCP server, you may need to install and configure dnsmasq or assign a static IP to the client in the same subnet as the Pi's Ethernet interface. Once connected, try pinging an external address like 8.8.8.8 from the client device. If the ping succeeds, Internet access is working. Try loading a webpage in a browser on the client to confirm full connectivity. If the connection fails, check the following:

• Ensure IP forwarding is still enabled.
• Verify that the iptables masquerade rule is present using sudo iptables -t nat -L -n -v.
• Check UFW logs for dropped packets using sudo tail -f /var/log/ufw.log.

For more details on resolving connectivity issues, see How to Fix Issue with Raspberry Pi that Can't Get Out to the Internet After Recent Changes Related to Wireguard/VPN or Troubleshooting Home Network Connectivity Issues on Linux Computer.

Frequently Asked Questions

Why can I ping 8.8.8.8 but cannot load websites?

This indicates a DNS resolution failure rather than a routing issue. Ensure your client device is using a valid DNS server, such as 8.8.8.8 or 1.1.1.1, in its network settings. You can test this by adding nameserver 8.8.8.8 to /etc/resolv.conf on the client.

Does UFW block NAT masquerading by default?

No, UFW primarily manages the filter table and does not interfere with the NAT table where masquerading occurs. However, if you have strict forwarding policies in UFW, you must explicitly allow traffic between interfaces using ufw route allow commands.

How do I reset the firewall rules if I get locked out?

You can flush all UFW rules by running sudo ufw reset. This will disable the firewall and restore default policies. Be cautious, as this opens all ports until you reconfigure the rules. Always have physical or console access to the Pi before resetting.

Can I share Wi-Fi over Bluetooth instead of Ethernet?

Yes, but the configuration is different. You would need to set up a PAN (Personal Area Network) gadget or use Bluetooth tethering. The principles of IP forwarding and NAT remain the same, but the interface names would be bth0 or similar, and you would configure the Bluetooth stack accordingly.

What happens if I reboot the Raspberry Pi?

If you did not install iptables-persistent or modify /etc/sysctl.conf, your changes will be lost. The system will revert to default settings, disabling IP forwarding and removing NAT rules. Always verify persistence by rebooting and testing connectivity again.