# iptables/routing/bridging question

## ralle

Hello!

I have a problem with my network, but first I will have to explain the situation:

I have a wireless accesspoint and router in the hall of my apartment. In my room there is my PC (let's call it PC1), which is always on. PC1 is connected to the router and the internet via wlan adaptor wlan0.

Furthermore, PC1 has an ethernet interface (eth0) which connects it to PC2 (my girlsfirends machine) and my XBOX.

So now to my problem: I want to have internet access on PC2 and XBOX. These machines should be able to reach the router via PC1.

In order to achieve this, I have created a bridge on PC1 which is connecting eth0 and wlan0 as a new interface br0 with only one ip. But I don't know if that was wise, because having one subnet for the wlan and one for the ethernet might also be possible.

Anyway, I don't know much of this stuff, and reading the iptables manual also did not help.

So if anybody knows how to accomplish this, please help.

----------

## grepcomputers

You should be able to do this with just iptables.

I'm not an iptables guru, but this should work (at least, this is how I share internet access from eth0 (connected to router) to eth1 (private network) on my machine):

```

echo "1" > /proc/sys/net/ipv4/ip_forward

/sbin/iptables -t filter -A FORWARD -i wlan0 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

/sbin/iptables -t filter -A FORWARD -i eth0 -o wlan0 -s <local_IP>/16 -j ACCEPT

/sbin/iptables -t nat -A POSTROUTING -o wlan0 -s <local_IP>/16 -j MASQUERADE

```

where eth0 is your local interface, wlan0 is your external interface, and <local_IP> is the ip address set to eth0.

cheers...

----------

## ralle

Thanks for the reply!

Nevertheless, it's not working till now.

I killed my bridge again and put wlan0 and eth0 on PC1 in two different subnets:

eth0: 192.168.1.55

wlan0: 192.168.0.55

Next I did this:

```

bender ~ #  echo "1" > /proc/sys/net/ipv4/ip_forward

bender ~ # /sbin/iptables -t filter -A FORWARD -i wlan0 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

bender ~ # /sbin/iptables -t filter -A FORWARD -i eth0 -o wlan0 -s 192.168.0.0/24 -j ACCEPT

bender ~ # /sbin/iptables -t nat -A POSTROUTING -o wlan0 -s 192.168.0.0/24 -j MASQUERADE

```

Next I changed PC2:

ip: 192.168.1.89 

gw: 192.168.1.55 (PC1 eth0)

Now from PC2 I can ping 192.168.1.55 (PC1 eth0) and 192.168.0.55 (PC1 wlan0). But I still cannot reach the router behind the wlan (192.168.0.21).

Any more ideas?

----------

## ralle

Just after sending the previous post I recognized my mistake:

I used the wrong subnet in the iptables commands (192.168.0.0 instead of correct 192.168.1.0).

It's all working now.

Thank you so much!

----------

## tigrezno

seting up a bridge it's all, no need to touch iptables.

----------

## ralle

Well I had the bridge running, but it obviously did not work...ping did not pass my wlan adaptor.

----------

## tigrezno

i'm speaking to you through a linux bridge without iptables support, something is wrong in your config.

i do the following in my bridge:

brctl addbr br0

brctl addif br0 eth0

brctl addif br0 eth1

ifconfig eth0 0.0.0.0

ifconfig eth1 0.0.0.0

ifconfig br0 192.168.0.2 netmask 255.255.255.0 broadcast 192.168.0.255

route add default gw 192.168.0.1

that's all.

----------

## ralle

I was using quite the same setup before switching to the configuration proposed by grepcomputers.

Both network interfaces on PC1 were bound to a bridge, and PC2 was able to ping it. Furthermore all devices were in the same subnet. The default route on PC1 was set to the router and worked great, the only problem was that PC2 was not able to get past PC1 into the internet. The default route on PC2 was set to PC1, but I also tried to set it directly to the router (which did not make sense, becauese PC2 could not even ping it).

So if you know where I did my mistake, let me know. I'd give it a spin just because I'd like to dig deeper in this bridging thing, I never got past ip masquerading for ppp0 concerning network setups and like to learn...

----------

## tigrezno

all your boxes must have as gateway your final router. The bridge is totally transparent in this aspect.

----------

## ralle

I don't know where things went wrong then. Maybe a bug in the wlan driver or something, but the bridge was not transparent in this case.

PC1 (the one with the bridge) was the only one who could reach both the wlan and the ethernet. PC2 could only reach machines on the ethernet side.

Probably I try this bridge setup again after I reboot next time to see if I b0rked something on the first run, until then I am pleased that everything works for the first time.

But thanks for your help, man!

----------

## cptmorgan

 *tigrezno wrote:*   

> i'm speaking to you through a linux bridge without iptables support, something is wrong in your config.
> 
> i do the following in my bridge:
> 
> brctl addbr br0
> ...

 

ive done this as well and cant get it to work.  the computer hosting the bridge works fine but i cant get the computer connected to it an ip.  is there a way to setup a dhcp server ?

----------

## ralle

I don't know what your network setup looks like, but maybe you should first configure the computer connected to the bridge manually to find out if it can reach machines behind the bridge. Then emerge dhcp and check out the config file in /etc.

I don't have dhcp installed, so I don't know the name of the file. You can check by running "epm -ql dhcp|grep etc".

----------

