How can I most simply transparently bridge traffic between wlan0 and eth0?

Question

I am looking to do this on a Raspberry Pi, but I don't mind which operating system I have to install, so the easiest most out-of-the-box solution for Pidora (Fedora 20 Remix), Raspbian (Debian) or Arch is the one I'd like.

I am living in a university building where internet access is supplied via a protected wireless network. This wireless network is authorised using WPA2-Enterprise PEAP and requires me to supply a username, password, and authentication certificate. The university provides a script to automatically configure a Linux machine for this network, and the script is happy working with either wpa_supplicant or network-manager - I've tried both.

I have a lot of machines (a mixture of Linux and Windows) which all talk to one another via my own private wireless router. This router has a WAN port meant to face an internet connection, so as to share that connection with all machines on its wireless network.

My aim is to have my Raspberry Pi connect to the university's protected wireless network and then provide an internet connection to the WAN port on my private wireless router. I've decided to use a Raspberry Pi because it's the lowest overhead device I have access to that is able to connect to my university's protected wireless network.

I do not need to be able to see my Raspberry Pi on my private wireless network (if I could that would be fine, but I'm really after the simplest configuration possible). All I need is for my Raspberry Pi to handle authentication to the university wireless network, and then transparently pass data between eth0 and wlan0. To any device plugged into my Raspberry Pi using an ethernet cable, the Raspberry Pi should just look like straight-forward internet gateway.

To summarise, I'm looking for,

(University Wi-Fi with WPA2 PEAP) -> (RPi wlan0)---(RPi eth0) -> (WAN on Private Router)

I've tried using bridge-utils on Debian, but this always seems to knock out my Raspberry Pi's wireless connection.

I've also read about using iptables and ebtables but, as yet, I don't really understand what I'm meant to be doing there, and some of the configurations I've found on the internet seem to conflict with one another.

I should add that the university wireless network dynamically assigns my Raspberry Pi an IP address on wlan0 each time it connects. My private router handles dynamic IP address assignment for all of my machines.

I would be so grateful if anyone could outline some simple clear instructions for achieving the setup I'm after. I am of course willing to read up on and learn anything I need to get this running, but I am interested in keeping the solution as simple and easy to reproduce as possible. The only device I want to configure is the Raspberry Pi.

I note that what I'm trying to do should be possible, because it's perfectly simple to share my university wireless network via my ethernet port on my Windows laptop!

Many thanks in advance!

Solution

This is as simple as it could be. You do not need any bridging. Just MASQUERADE your local network on RPi:

iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

Enable forwarding of traffic:

echo 1 > /proc/sys/net/ipv4/ip_forward

RPi will not work as invisible bump-on-the-wire but will need a network setup between it and your private router – which will use ip address of RPi's eth0 as gateway.

So it will look like this:

(RPi wlan0) -- MASQUERADE -- (RPi eth0;192.168.99.254/24) → (WAN on Private Router,192.168.99.1/24)

Cheers,

Comments

[snoopy91]

Thanks Sclyd - I will try this as soon as I get home. In this setup who assigns eth0 on my RPi an IP address? Is it my private router? Or is it the university network?

[snoopy91]

This doesn't seem to be working. The minute I plug my RPi into my router's WAN port the RPi's wlan0 loses its IP address (and the dongle stops flashing.) I've tried manually setting the router to 192.168.0.1 with the RPi's eth0 to 192.168.0.2 (subnet mask 255.255.255.0) but to no avail. What should the gateway IP address be in this case? What am I missing?

[Scyld de Fraud]

First of all you need to have the external link (RPi's wifi usb adapter) to be fully operational. It might be a problem with power supply of RPi's not up to the job. If you can, try connecting wifi adapter to powered hub. For your network configuration, gateway – on private router – will be 192.168.0.2 (RPi's eth0).

[snoopy91]

I'm pretty sure it's not a power restriction problem because if I ping the Internet from the RPi over university wifi as I plug in the ethernet connection to the router, there is a period of time during which the ethernet connection is initialising for which the wifi pinging continues successfully. Unfortunately I don't have a powered hub to hand to verify. I also notice that, when plugged into a Windows machine, if I run ifconfig on the RPi both eth0 and wlan0 have IP addresses on the university network.

[Scyld de Fraud]

It can be the effect of working ifplugd. Try some of fixes reported in this article. You should also configure static ip addressing for eth0 in /etc/network/interfaces file, like this: # The primary network interface auto eth0 iface eth0 inet static address 192.168.0.2 netmask 255.255.255.0 network 192.168.0.0 broadcast 192.168.0.255

[snoopy91]

Thanks for your help. Removing ifplugd and setting the RPi eth0 to 192.168.0.1, the router WAN interface to 192.168.0.2, netmask on both to 255.255.255.0, and gateway on both to 192.168.0.1 has done the trick!!! My final question - where is the best place to put the iptables command to make it execute on boot?

[snoopy91]

No worries - I just discovered iptable-persistent! Thank you so much for all your help!