Verifying Interface Configuration
The first step in resolving this connectivity problem is to confirm that your interfaces are correctly assigned and active. You must identify which interface connects to your internet source, usually eth0 for wired Ethernet, and which serves as the access point, often wlan0. Use the command ip addr show to list all network interfaces and their IP addresses. Ensure that the Ethernet interface has a valid IP address assigned by your router or DHCP server, and that the Wi-Fi interface has a static IP within its own subnet, such as 192.168.50.1/24.
If you are using hostapd to manage the access point, verify that the configuration file in /etc/hostapd/hostapd.conf points to the correct interface. The line interface=wlan0 should match the identifier you found earlier. Additionally, check that the DHCP server, typically dnsmasq, is configured to hand out addresses on the same subnet as the AP interface. A mismatch here will prevent clients from obtaining valid routing information.
Configuring Kernel Parameters for Forwarding
The Linux kernel disables IP forwarding by default for security reasons. To allow traffic to pass through your Raspberry Pi, you must enable this feature. Open the sysctl configuration file using a text editor with root privileges: sudo nano /etc/sysctl.conf. Look for the line containing net.ipv4.ip_forward. If it is commented out with a hash symbol, remove the hash. If the line does not exist, add net.ipv4.ip_forward=1 at the end of the file.
After saving the changes, apply them immediately without rebooting by running sudo sysctl -p. You can verify that forwarding is active by checking the runtime value with cat /proc/sys/net/ipv4/ip_forward. The output should be 1. If it remains 0, there may be a syntax error in your configuration file or a conflicting service is overriding the setting. Persistent errors often require checking system logs with journalctl -u sysctl.service for clues.
Establishing NAT Rules with Iptables
Even with forwarding enabled, your Raspberry Pi needs to masquerade outgoing traffic so that return packets know where to go. This process is known as Source Network Address Translation (SNAT). You need to add a rule to the nat table that modifies the source address of packets leaving via the internet-facing interface. Execute the following command, replacing eth0 with your actual WAN interface name:
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEThis command tells the kernel to replace the source IP of any packet originating from the local network and exiting through eth0 with the IP address of eth0. However, these rules are volatile and will disappear upon reboot. To make them permanent, you should install the iptables-persistent package. Run sudo apt install iptables-persistent and follow the prompts to save current IPv4 and IPv6 rules. This ensures your NAT configuration survives restarts.
Managing Firewall Policies
While NAT handles address translation, the firewall controls whether packets are allowed to traverse the system. By default, many distributions drop forwarded traffic. You must explicitly allow forwarding between your LAN and WAN interfaces. Add the following rules to accept traffic going from the Wi-Fi network to the internet and vice versa:
sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPTThe first rule allows new connections initiated by clients on wlan0. The second rule permits return traffic for existing connections, which is crucial for maintaining stable sessions. Again, if you installed iptables-persistent, save these rules after adding them. Failure to configure these policies results in silent packet drops, where clients appear connected but have no internet access.
Troubleshooting DNS Resolution
If clients can ping external IPs like 8.8.8.8 but cannot load websites, the issue likely lies with DNS resolution. Clients are receiving IP addresses from dnsmasq, which should also act as a DNS forwarder. Check the /etc/dnsmasq.conf file to ensure it includes a line like server=8.8.8.8 or uses your local router's DNS. Restart the dnsmasq service with sudo systemctl restart dnsmasq to apply changes.
You can test DNS resolution directly on the Raspberry Pi using nslookup google.com. If this fails, check your upstream DNS connectivity. In some cases, cloudflare or google DNS servers may be blocked by certain ISPs. Switching to alternative DNS providers in the dnsmasq configuration can resolve this. Additionally, ensure that systemd-resolved is not interfering with your local DNS setup by checking its status.
Frequently Asked Questions
Why do my clients lose internet access after a reboot?
This happens because iptables rules and sysctl settings are stored in memory and cleared on shutdown. You must use iptables-persistent to save firewall rules and ensure sysctl.conf contains the correct forwarding directive. Without persistence, the system reverts to default secure settings that block traffic.
Can I use UFW instead of raw iptables commands?
Yes, Uncomplicated Firewall (UFW) can manage these rules more easily. Enable forwarding in /etc/default/ufw by setting IPT_SYSCTL=/etc/ufw/sysctl.conf and then use ufw route commands. This abstracts the complexity of manual iptable entries while achieving the same result.
How do I verify that NAT is actually working?
Use sudo iptables -t nat -L -v -n to view detailed statistics for your NAT rules. Look for packet counters increasing as clients generate traffic. If the counters remain zero, the rule is either not being hit due to interface mismatches or is being blocked by the FORWARD chain.
What if my Raspberry Pi gets an IP via DHCP on eth0?
Masquerading works regardless of whether eth0 has a static or dynamic IP. The MASQUERADE target automatically detects the current IP of the outbound interface. However, ensure that your router's DHCP lease time is reasonable to avoid frequent IP changes that might confuse long-lived connections.
Are there alternative ways to share internet besides hostapd?
You can use nmcli to create a hotspot via NetworkManager, which automates much of the iptables configuration. Alternatively, pi-hole setups often include built-in AP modes. For simple sharing, enabling internet sharing in the desktop environment's GUI is an option, though less robust for headless servers.