IPTables NAT Configuration: Laptop to OrangePi1 to OrangePi2

Configure IPTables NAT on the OrangePi1 acting as a gateway to route traffic from the laptop through the OrangePi2 to the internet. This setup requires enabling IP forwarding, setting up masquerading on the upstream interface of OrangePi1, and ensuring proper routing rules exist between the local subnet and the OrangePi2 bridge.

Network Topology and Assumptions

The network consists of three primary nodes: a Laptop, an OrangePi1 (Gateway), and an OrangePi2 (Upstream/Internet Gateway). The Laptop connects directly to OrangePi1 via Ethernet or Wi-Fi. OrangePi1 connects to OrangePi2, which in turn connects to the external network. We assume OrangePi1 has two network interfaces: one facing the Laptop (e.g., eth0 or wlan0) and one facing OrangePi2 (e.g., eth1). OrangePi2 is configured to provide DHCP and handle the actual WAN connection. If your physical connections differ, adjust the interface names accordingly using ip link show.

Enabling IP Forwarding

For OrangePi1 to act as a router, it must be able to forward packets between its interfaces. By default, Linux kernels drop forwarded packets for security reasons. You need to enable IP forwarding permanently. Edit the sysctl configuration file:

sudo nano /etc/sysctl.conf

Add or uncomment the following line:

net.ipv4.ip_forward = 1

Apply the changes immediately without rebooting by running:

sudo sysctl -p

Verify that forwarding is active by checking the value:

cat /proc/sys/net/ipv4/ip_forward

A output of 1 confirms the setting is active. This step is critical; without it, even correct IPTables rules will not allow traffic to pass through OrangePi1.

Configuring IPTables Masquerading

NAT masquerading allows devices on the local network (Laptop) to use OrangePi1's public IP address when communicating with the outside world. On OrangePi1, you must configure the POSTROUTING chain in the nat table. Replace eth1 with the interface connected to OrangePi2.

sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

This rule tells the kernel to modify the source IP address of outgoing packets on eth1 to match the IP address of that interface. For persistent rules across reboots, save the current IPTables configuration. On Debian-based systems like OrangePi OS, use:

sudo apt-get install iptables-persistent
sudo netfilter-persistent save

Refer to our guide on Understanding NAT Masquerading in iptables for deeper insights into how this mechanism handles dynamic IP addresses.

Routing and Firewall Rules

Beyond NAT, you must ensure that return traffic from OrangePi2 reaches the Laptop. OrangePi1 needs to accept forwarded packets from its internal interface. Add the following rules to the FORWARD chain:

sudo iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT

The first rule allows return traffic for established connections. The second rule permits new outbound connections initiated by the Laptop. If you have strict firewall policies, ensure that port forwarding rules are added if specific services on the Laptop need to be accessible from the WAN.

Troubleshooting Connectivity

If the Laptop cannot access the internet, verify the routing table on OrangePi1. Ensure there is a default route pointing towards OrangePi2:

ip route show

You should see a default route via the IP address of OrangePi2 on the eth1 network. Check ARP tables to ensure OrangePi1 can resolve OrangePi2's MAC address:

arp -n

If ARP entries are missing, check the physical cabling and switch configurations. Also, verify that OrangePi2 is correctly configured to forward traffic back to OrangePi1. Consult Troubleshooting Home Network Connectivity Issues on Linux Computer for broader diagnostic steps.

Frequently Asked Questions

Why does my laptop lose internet after reboot?

IPTables rules are volatile and reset upon reboot unless saved. Always use netfilter-persistent save or your distribution's equivalent service to persist rules. Additionally, ensure net.ipv4.ip_forward=1 is set in /etc/sysctl.conf so it loads automatically at boot time.

Can I use static IPs instead of NAT?

Yes, but it is more complex. You would need to configure static routes on OrangePi2 pointing to the Laptop's subnet via OrangePi1. NAT is preferred for home setups because it hides the internal topology and simplifies addressing.

What if OrangePi2 is also running iptables?

If OrangePi2 has its own firewall, ensure it allows traffic originating from OrangePi1's LAN subnet. Sometimes, restrictive default DROP policies on the upstream device block forwarded traffic. Check the FORWARD chain on OrangePi2 specifically.

How do I test if NAT is working?

From the Laptop, run curl ifconfig.me. The returned IP should be the public IP of OrangePi2, not the Laptop's private IP. If it shows a private IP, NAT is not functioning correctly.

Is this setup secure?

It provides basic isolation by hiding the Laptop from the internet. However, it does not replace a full firewall. Ensure you only open necessary ports if you plan to host services on the Laptop. Regularly update both OrangePi devices to patch kernel vulnerabilities.