![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2020\/09\/image-99.png\")
<\/figure>\nWhat is necessary:<\/p>\n
- \n
- WiFi already set up with Internet access.<\/li>\n
- Laptop or Raspberry Pi with a wireless card<\/li>\n
- Linux operating system (Ubuntu or Raspbian)<\/li>\n
- Ethernet cable<\/li>\n
- The device you want to connect (TV, computer, printer, etc.)<\/li>\n<\/ul>\n
What will be configured:<\/p>\n
- \n
- Configure the NIC (network adapter)<\/li>\n
- Install a DHCP server (auto-assigns IPs) [learn more<\/a> – CertBros]<\/li>\n
- Configure NAT (routing) [learn more<\/a> – CertBros]<\/li>\n
- Install a DNS server (optional) [learn more<\/a> – Techquickie]<\/li>\n<\/ul>\n
Configuring the NIC<\/strong><\/p>\n
ip a<\/pre>\n
1: lo: <\/strong><omitted unnecessary text><\/em>
\ninet 127.0.0.1\/8 scope host lo
\n <omitted unnecessary text><\/em>
\n 2: eth0: <\/strong><omitted unnecessary text><\/em>
\ninet 172.16.1.1\/24<\/strong> brd 172.16.1.255 scope global noprefixroute eth0
\n<omitted unnecessary text><\/em>
\n 3: wlan0:<\/strong> <omitted unnecessary text>
\ninet 192.168.2.40\/24<\/strong> brd 192.168.2.255 scope global dynamic<\/strong> noprefixroute wlan0
\n<omitted unnecessary text><\/em><\/p>\n1: lo:<\/strong> The loopback interface. Ignore this virtual interface.<\/p>\n
2: eth0:<\/strong> The Ethernet adapter that will be connected to the TV, computer, printer, etc.<\/p>\n
3: wlan0:<\/strong> The wireless adapter that must be connected to your WiFi with a working Internet connection.<\/p>\n
Note: Interface names may vary. In this example, eth0 (LAN)<\/strong> and wlan0 (WAN)<\/strong>.<\/p>\n
In this example, eth0 is already manually configured<\/strong>.<\/p>\n
On Ubuntu, configure eth0 using the graphical interface as shown below:<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2020\/09\/image-4.png\")
<\/figure>\nOn Raspbian, configure eth0 via the terminal by editing \/etc\/dhcpcd.conf:<\/p>\n
sudo nano \/etc\/dhcpcd.conf<\/pre>\n
Add this code at the end of the file:<\/p>\n
interface eth0\r\nstatic ip_address=172.16.1.1\/24\r\nnogateway<\/pre>\n
Restart the computer after making this change.<\/p>\n
Pay attention to the IPs in the new scenario:<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2020\/09\/image-7.png\")
<\/figure>\nRegardless of whether you are setting up a laptop + TV or a Raspberry Pi + PC, pay attention to the color-coded IPs. All orange IPs are in the same subnet; blue and green IPs belong to other subnets.<\/p>\n
The TV and PC each need an IP to communicate on the subnet. You can either configure each device manually or let them get an IP automatically via DHCP.<\/p>\n
Installing the DHCP Server<\/strong><\/p>\n
sudo apt-get update\r\nsudo apt-get install isc-dhcp-server -y\r\nsudo nano \/etc\/default\/isc-dhcp-server<\/pre>\n
Set the network adapter that DHCP will serve (LAN):<\/p>\n
INTERFACESv4=\"eth0<\/strong>\"<\/pre>\n
Edit the configuration file:<\/p>\n
sudo nano \/etc\/dhcp\/dhcpd.conf<\/pre>\n
Clear the file and replace it with this:<\/p>\n
default-lease-time 600;\r\nmax-lease-time 7200;\r\noption subnet-mask 255.255.255.0;\r\noption broadcast-address 172.16.1.255;\r\noption routers 172.16.1.1;\r\noption domain-name-servers 8.8.8.8, 8.8.4.4;\r\noption domain-name \"host.local\";\r\nsubnet 172.16.1.0 netmask 255.255.255.0 {\r\nrange 172.16.1.10 172.16.1.100;\r\n}<\/pre>\nRun the following commands:<\/p>\n
sudo systemctl restart isc-dhcp-server\r\nsudo systemctl enable isc-dhcp-server\r\nsudo systemctl status isc-dhcp-server<\/pre>\n
The second command may fail on Raspbian. That is fine, just continue.<\/p>\n
Verify that the service is ACTIVE (shown in green):<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2020\/09\/image-8.png\")
<\/figure>\nDevices can now get their IP configuration automatically:<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2020\/09\/image-9.png\")
<\/figure>\nAll of this configuration is customizable. In the example above, the laptop and the Raspberry Pi intentionally share the same IP address range, but they are on physically separate networks. The same applies to the TV and PC; they may both receive the first available IP from their respective DHCP servers. Verify that each device received its IP correctly.<\/p>\n
Configuring NAT (for Ubuntu):<\/strong><\/p>\n
sudo ufw enable\r\nsudo nano \/etc\/ufw\/sysctl.conf<\/pre>\n
Uncomment the following line, or add it if it is not present:<\/p>\n
net\/ipv4\/ip_forward=1<\/pre>\n
Do the same in \/etc\/sysctl.conf<\/strong>.<\/p>\n
Edit the startup script:<\/p>\n
sudo nano \/etc\/rc.local<\/pre>\n
Paste this content into the file:<\/p>\n
#!\/bin\/bash\r\niptables -P INPUT DROP\r\niptables -P FORWARD DROP\r\niptables -A INPUT -i lo -j ACCEPT\r\niptables -A INPUT -i eth0 -j ACCEPT\r\niptables -A INPUT -i wlan0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\r\niptables -t nat -A PREROUTING -p tcp -d 192.168.2.40<\/strong> --dport 80<\/strong> -j DNAT --to-destination 172.16.1.10<\/strong>:80<\/strong><\/em>\r\niptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT\r\niptables -A FORWARD -i wlan0 -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT\r\niptables -t nat -A POSTROUTING -j MASQUERADE\r\nexit 0<\/pre>\n
Note: the italicized line in the middle is a template for Static NAT (Port Forwarding). Replace 192.168.2.40<\/strong> with your public IP and 172.16.1.10<\/strong> with your private IP (a web server in this case, on port 80<\/strong>). If you are not using port forwarding, simply delete that line. See the illustration below:<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2020\/09\/image-9_.png\")
<\/p>\nMake the file executable:<\/p>\n
sudo chmod 755 \/etc\/rc.local<\/pre>\n
Configuring NAT (for Raspbian):<\/strong><\/p>\n
sudo nano \/etc\/rc.local<\/pre>\n
Add this code at the end of the file, right before<\/strong> the last line: exit 0<\/strong><\/p>\n
iptables -A INPUT -i lo -j ACCEPT\r\niptables -A INPUT -i eth0 -j ACCEPT\r\niptables -A INPUT -i wlan0 -m conntrack \\\r\n--ctstate ESTABLISHED,RELATED -j ACCEPT\r\niptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT\r\niptables -A FORWARD -i wlan0 -o eth0 -m conntrack \\\r\n--ctstate ESTABLISHED,RELATED -j ACCEPT\r\niptables -t nat -A POSTROUTING -j MASQUERADE\r\nsystemctl start isc-dhcp-server<\/pre>\n
Restart Ubuntu\/Raspbian<\/strong> for the changes to take effect, then verify that the TV and\/or PC have Internet access<\/strong>.<\/p>\n
Installing the DNS Server (optional)<\/strong><\/p>\n
With the current configuration, the DHCP server automatically points devices (TV, PC, printer, etc.) to Google’s public DNS servers (8.8.8.8 and 8.8.4.4). Another option is to use your wireless router’s DNS server (in this example, 192.168.2.1).<\/p>\n
You can also set up your own private DNS server for full control. This lets you apply blacklists or whitelists for parental controls, business policies, or any other purpose.<\/p>\n
sudo apt install bind9 -y\r\nsudo nano \/etc\/bind\/named.conf.options<\/pre>\n
Replace the entire file content with:<\/p>\n
options{\r\ndirectory \"\/var\/cache\/bind\";\r\nrecursion yes;\r\nforwarders {\r\n8.8.8.8;\r\n8.8.4.4;\r\n};\r\nforward only;\r\n};<\/pre>\nNote: the DNS server forwards requests it does not know how to resolve. After the first lookup, it caches the result for faster responses going forward.<\/p>\n
Restart the DNS and DHCP servers:<\/p>\n
sudo systemctl restart bind9\r\nsudo systemctl restart isc-dhcp-server.service<\/pre>\n
Now restart all connected devices so they request a new configuration from the DHCP server and begin using the local DNS server.<\/p>\n
Everything is set up and running!<\/strong><\/p>\n
To reserve a specific IP for a device, append the following to \/etc\/dhcp\/dhcpd.conf<\/strong>:<\/p>\n
host mytv {\r\nhardware ethernet A4:BA:DB:14:BD:4F;\r\nfixed-address 192.168.110.10;\r\n}<\/pre>\n
\nBONUS<\/strong><\/p>\n
For port forwarding on a single network interface:<\/p>\n
#!\/bin\/bash\r\niptables -P INPUT DROP\r\niptables -P FORWARD DROP\r\niptables -A INPUT -i lo -j ACCEPT\r\niptables -A INPUT -i eth0<\/strong> -j ACCEPT\r\niptables -t nat -A PREROUTING -p tcp -d 192.168.1.5<\/strong><\/span> --dport 443<\/strong><\/span> -j DNAT --to-destination 192.168.1.50<\/span><\/strong>:443<\/span><\/strong>\r\niptables -A FORWARD -s 192.168.1.0<\/strong><\/span>\/24<\/strong> -j ACCEPT\r\niptables -t nat -A POSTROUTING -j MASQUERADE\r\nexit 0<\/pre>\nAlternatively, use nftables<\/strong> to manage iptables<\/strong> rules:<\/p>\n
sudo ufw disable\r\nsudo systemctl disable ufw\r\nsudo apt install nftables -y\r\nsudo systemctl enable nftables\r\nsudo sed -i 's\/#net.ipv4.ip_forward=1\/net.ipv4.ip_forward=1\/g' \/etc\/sysctl.conf\r\nsudo sysctl -p\r\nsudo nft list ruleset\r\nsudo nft flush ruleset\r\nsudo nft list ruleset\r\nsudo nft flush ruleset\r\nsudo nft add table nat\r\nsudo nft 'add chain nat postrouting { type nat hook postrouting priority 100 ; }'\r\nsudo nft 'add chain nat prerouting { type nat hook prerouting priority -100; }'\r\nsudo nft 'add rule nat prerouting ip daddr 192.168.1.5<\/strong><\/span> tcp dport { 21<\/strong><\/span> } dnat 192.168.1.50<\/span><\/strong>:21<\/strong><\/span>'\r\nsudo nft 'add rule nat prerouting ip daddr 192.168.1.5<\/strong><\/span> tcp dport { 60000-65000<\/span><\/strong> } dnat 192.168.1.50<\/span><\/strong>:60000-65000<\/strong><\/span>'\r\nsudo nft add rule nat postrouting masquerade\r\nsudo nft list ruleset | sudo tee \/etc\/nftables.conf<\/pre>\nTo manage rules:<\/p>\n
sudo nft -a list table nat\r\nsudo nft delete rule nat prerouting handle 7<\/pre>\n
How to configure NAT with nftables<\/strong>:<\/p>\n
sudo nano \/etc\/sysctl.conf<\/pre>\n
net.ipv4.ip_forward = 1<\/pre>\n
sudo nano \/etc\/nftables.conf<\/pre>\n
table inet nat {\r\n chain prerouting {\r\n type nat hook prerouting priority -100; policy accept;\r\n }\r\n chain postrouting {\r\n type nat hook postrouting priority 100; policy accept;\r\n oifname \"eth0\" masquerade\r\n }\r\n}\r\ntable inet filter {\r\n chain forward {\r\n type filter hook forward priority 0; policy drop;\r\n iifname \"eth1\" oifname \"eth0\" accept\r\n ct state established,related accept\r\n }\r\n}<\/pre>\nsudo sysctl -p\r\nsudo nft -f \/etc\/nftables.conf<\/pre>\n","protected":false},"excerpt":{"rendered":"This post will show how to share the Internet between two network adapters on Ubuntu […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,6],"tags":[],"class_list":["post-191","post","type-post","status-publish","format-standard","hentry","category-linux","category-raspberry-pi"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=191"}],"version-history":[{"count":19,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/191\/revisions"}],"predecessor-version":[{"id":5849,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/191\/revisions\/5849"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Configure NAT (routing) [learn more<\/a> – CertBros]<\/li>\n