Difference between revisions of "Internet sharing"

From ArchWiki
Jump to: navigation, search
m (Enable packet forwarding: Typo: temporaly -> temporarily)
(re-add link to the wifi article)
 
(59 intermediate revisions by 22 users not shown)
Line 1: Line 1:
[[Category:Networking]]
+
[[Category:Network sharing]]
[[cs:Internet Share]]
+
[[cs:Internet sharing]]
[[es:Conexion a Internet compartida]]
+
 
[[fr:Partage de connexion]]
 
[[fr:Partage de connexion]]
[[it:Internet Share]]
+
[[it:Internet sharing]]
[[ru:Internet Share]]
+
[[ja:インターネット共有]]
This article explains how to share the internet connection from one machine to other(s).
+
[[ru:Internet sharing]]
 +
{{Related articles start}}
 +
{{Related|Android tethering}}
 +
{{Related|Software access point}}
 +
{{Related|Bridge with netctl}}
 +
{{Related|Ad-hoc networking}}
 +
{{Related|Sharing PPP Connection}}
 +
{{Related|Simple stateful firewall}}
 +
{{Related|Router}}
 +
{{Related|USB 3G Modem}}
 +
{{Related articles end}}
 +
This article explains how to share the internet connection from one machine to other(s).  
  
 
== Requirements ==
 
== Requirements ==
  
* The machine acting as server should have an additional network device.
+
The machine acting as server should have an additional network device. That network device requires a functional [[w:data link layer]] to the machine(s) that are going to receive internet access:
* That network device should be connected to the machines that are going to receive internet access. They can be one or more machines. To be able to share internet to several machines a [[Wikipedia:Network switch|switch]] is required. If you are sharing to only one machine, a [[Wikipedia:Ethernet crossover cable|crossover cable]] is sufficient.
+
* To be able to share internet to several machines a [[Wikipedia:Network switch|switch]] can provide the data link.  
 
+
* A wireless device can share access to several machines as well, see [[Software access point]] first for this case.
{{Note|If one of the two computers has a gigabit ethernet card, a crossover cable is not necessary and a regular ethernet cable should be enough}}
+
* If you are sharing to only one machine, a [[Wikipedia:Ethernet crossover cable|crossover cable]] is sufficient. In case one of the two computers' ethernet cards has [[w:Medium Dependent Interface#Auto_MDI-X|MDI-X]] capability, a crossover cable is not necessary and a regular ethernet cable can be used. Executing {{ic|ethtool ''interface'' <nowiki>|</nowiki> grep MDI}} as root helps to figure it.
  
 
== Configuration ==
 
== Configuration ==
Line 19: Line 29:
  
 
{{Tip|You can rename your devices to this scheme using [[Udev#Setting static device names]].}}
 
{{Tip|You can rename your devices to this scheme using [[Udev#Setting static device names]].}}
 +
 +
All configuration is done on the server computer, except for the final step of [[#Assigning IP addresses to the client PC(s)]].
  
 
=== Static IP address ===
 
=== Static IP address ===
  
Assign an static IPv4 address to the interface connected to the other machines. The first 3 bytes of this address cannot be exactly the same as those of another interface.
+
On the server computer, assign a static IPv4 address to the interface connected to the other machines. The first 3 bytes of this address cannot be exactly the same as those of another interface.
 
  # ip link set up dev net0
 
  # ip link set up dev net0
  # ip addr add 139.96.30.100/24 dev net0 # arbitrary address
+
  # ip addr add 192.168.123.100/24 dev net0 # arbitrary address
  
 
To have your static ip assigned at boot, you can use [[netctl]].
 
To have your static ip assigned at boot, you can use [[netctl]].
Line 30: Line 42:
 
=== Enable packet forwarding ===
 
=== Enable packet forwarding ===
  
Enter this command to temporarily enable packet forwarding:
+
Check the current packet forwarding settings:
 +
# sysctl -a | grep forward
 +
 
 +
You will note that options exist for controlling forwarding per default, per interface, as well as separate options for IPv4/IPv6 per interface.
 +
 
 +
Enter this command to temporarily enable packet forwarding at runtime:
 
  # sysctl net.ipv4.ip_forward=1
 
  # sysctl net.ipv4.ip_forward=1
  
Edit {{ic|/etc/sysctl.conf}} to make the previous change persistent after a reboot.
+
{{Tip|To enable packet forwarding selectively for a specific interface, use {{ic|1=sysctl net.ipv4.conf.''interface_name''.forwarding=1}} instead.}}
{{hc|/etc/sysctl.conf|<nowiki>
+
net.ipv4.ip_forward=1
+
</nowiki>}}
+
  
If you are using ipv6, use this:
+
{{Warning|If the system uses [[systemd-networkd]] to control the network interfaces, a per-interface setting for IPv4 is not possible, i.e. systemd logic propagates any configured forwarding into a global (for all interfaces) setting for IPv4. The advised work-around is to use a firewall to forbid forwarding again on selective interfaces. See the systemd.network(5) manual page for more information.
{{hc|/etc/sysctl.conf|<nowiki>
+
The {{ic|1=IPForward=kernel}} semantics introduced in a previous systemd release 220/221 to honor kernel settings does not apply anymore.[https://github.com/poettering/systemd/commit/765afd5c4dbc71940d6dd6007ecc3eaa5a0b2aa1] [https://github.com/systemd/systemd/blob/a2088fd025deb90839c909829e27eece40f7fce4/NEWS]}}
 +
 
 +
Edit {{ic|/etc/sysctl.d/30-ipforward.conf}} to make the previous change persistent after a reboot for all interfaces:
 +
{{hc|/etc/sysctl.d/30-ipforward.conf|<nowiki>
 +
net.ipv4.ip_forward=1
 
net.ipv6.conf.default.forwarding=1
 
net.ipv6.conf.default.forwarding=1
 
net.ipv6.conf.all.forwarding=1
 
net.ipv6.conf.all.forwarding=1
 
</nowiki>}}
 
</nowiki>}}
 +
 +
Afterwards it is advisable to double-check forwarding is enabled as required after a reboot.
  
 
=== Enable NAT ===
 
=== Enable NAT ===
  
[[pacman|Install]] the package {{Pkg|iptables}} from the [[Official Repositories|official repositories]]. Use iptables to enable NAT:
+
[[Install]] the package {{Pkg|iptables}} from the [[official repositories]]. Use iptables to enable NAT:
  
 
  # iptables -t nat -A POSTROUTING -o internet0 -j MASQUERADE
 
  # iptables -t nat -A POSTROUTING -o internet0 -j MASQUERADE
  # iptables-save > /etc/iptables/iptables.rules
+
  # iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
  # systemctl start iptables
+
  # iptables -A FORWARD -i net0 -o internet0 -j ACCEPT
  
{{Note|Of course, this also works with a mobile broadband connection (usually called ppp0 on PC1).}}
+
{{Note|Of course, this also works with a mobile broadband connection (usually called ppp0 on routing PC).}}
  
{{Tip|You can set {{ic|iptables.service}} to [[Daemon|auto start at boot]].}}
+
Read the [[iptables]] article for more information (especially saving the rule and applying it automatically on boot). There is also an excellent guide on iptables [[Simple stateful firewall]].
  
Read the [[iptables]] article for more information. There's also an excellent guide on iptables [[Simple stateful firewall]].
+
=== Assigning IP addresses to the client PC(s) ===
  
=== Assigning ip addresses to the client pc(s) ===
+
If you are planning to regularly have several machines using the internet shared by this machine, then is a good idea to install a [[Wikipedia:DHCP|DHCP server]], such as [[dhcpd]] or [[dnsmasq]]. Then configure a DHCP client (e.g. [[dhcpcd]]) on every client PC.
  
If you are planning to regularly have several machines using the internet shared by this machine, then is a good idea to install a [[Wikipedia:dhcp|dhcp server]].
+
{{Style|This is not an iptables guide. Expanding the chain with {{ic|iptables -I}} might skip other important rules; if you need to script an ON/OFF switch for this, use custom chain with a jump placed carefully in the INPUT chain.}}
  
You can read the [[dhcpd]] wiki article, to add a dhcp server. Then, install the [[dhcpcd]] client on every client pc.
+
Incoming connections to UDP port 67 has to be allowed for DHCP server. It also necessary to allow incoming connections to UDP/TCP port 53 for DNS requests.
 +
# iptables -I INPUT -p udp --dport 67 -i net0 -j ACCEPT
 +
# iptables -I INPUT -p udp --dport 53 -s 192.168.123.0/24 -j ACCEPT
 +
# iptables -I INPUT -p tcp --dport 53 -s 192.168.123.0/24 -j ACCEPT
  
If you are not planing to use this setup regularly, you can manually add an ip to each client instead.
+
If you are not planing to use this setup regularly, you can manually add an IP to each client instead.
  
==== Manually adding an ip ====
+
==== Manually adding an IP ====
  
Instead of using dhcp, on each client pc, add an ip address and the default route:
+
Instead of using DHCP, on each client PC, add an IP address and the default route:
  # ip addr add 139.96.30.120/24 dev eth0
+
  # ip addr add 192.168.123.201/24 dev eth0 # arbitrary address, first three blocks must match the address from above
 
  # ip link set up dev eth0
 
  # ip link set up dev eth0
  # ip route add default via 139.96.30.100 dev eth0
+
  # ip route add default via 192.168.123.100 dev eth0   # same address as in the beginning
  
Add a nameserver:
+
Configure a DNS server for each client, see [[resolv.conf]] for details.
# echo "nameserver <nameserver ip>" >> /etc/resolv.conf
+
 
+
You can figure out the address of the nameserver by looking into the {{ic|/etc/resolv.conf}} of the server, if its Internet connection is already established.
+
 
+
If you don't have a nameserver, you can use any of the free public DNS servers, which are relatively fast:
+
* [https://code.google.com/speed/public-dns/ Google Public DNS]
+
** 8.8.8.8
+
** 8.8.4.4
+
** [2001:4860:4860::8888]
+
** [2001:4860:4860::8844]
+
* [https://opendns.com OpenDNS]:
+
** 208.67.222.222
+
** 208.67.220.220
+
** [2620:0:ccc::2]
+
** [2620:0:ccd::2]
+
 
+
{{Note|Bracket notation must be used for IPv6 addresses in resolv.conf.}}
+
  
 
That's it. The client PC should now have Internet.
 
That's it. The client PC should now have Internet.
Line 96: Line 102:
 
== Troubleshooting ==
 
== Troubleshooting ==
  
If you are able to connect the two PCs but cannot send data (for example, if the client PC makes a DHCP request to the server PC, the server PC receives the request and offers an IP to the client, but the client does not accept it, timing out instead), check that you don't have other [[Iptables]] rules [https://bbs.archlinux.org/viewtopic.php?pid=1093208 interfering].
+
If you are able to connect the two PCs but cannot send data (for example, if the client PC makes a DHCP request to the server PC, the server PC receives the request and offers an IP to the client, but the client does not accept it, timing out instead), check that you do not have other [[Iptables]] rules [https://bbs.archlinux.org/viewtopic.php?pid=1093208 interfering].
  
 
== See also ==
 
== See also ==
 
+
* [http://xyne.archlinux.ca/notes/network/dhcp_with_dns.html Xyne's guide and scripts for launching a subnet with DHCP and DNS]
* [[Ad-hoc networking]]
+
* [[NetworkManager]] can be configured for internet sharing if used.
* [[Sharing PPP Connection]]
+
* [[Simple stateful firewall]]
+
* [[Router]]
+
* [[USB 3G Modem]]
+

Latest revision as of 20:47, 13 June 2016

This article explains how to share the internet connection from one machine to other(s).

Requirements

The machine acting as server should have an additional network device. That network device requires a functional w:data link layer to the machine(s) that are going to receive internet access:

  • To be able to share internet to several machines a switch can provide the data link.
  • A wireless device can share access to several machines as well, see Software access point first for this case.
  • If you are sharing to only one machine, a crossover cable is sufficient. In case one of the two computers' ethernet cards has MDI-X capability, a crossover cable is not necessary and a regular ethernet cable can be used. Executing ethtool interface | grep MDI as root helps to figure it.

Configuration

This section assumes, that the network device connected to the client computer(s) is named net0 and the network device connected to the internet as internet0.

Tip: You can rename your devices to this scheme using Udev#Setting static device names.

All configuration is done on the server computer, except for the final step of #Assigning IP addresses to the client PC(s).

Static IP address

On the server computer, assign a static IPv4 address to the interface connected to the other machines. The first 3 bytes of this address cannot be exactly the same as those of another interface.

# ip link set up dev net0
# ip addr add 192.168.123.100/24 dev net0 # arbitrary address

To have your static ip assigned at boot, you can use netctl.

Enable packet forwarding

Check the current packet forwarding settings:

# sysctl -a | grep forward

You will note that options exist for controlling forwarding per default, per interface, as well as separate options for IPv4/IPv6 per interface.

Enter this command to temporarily enable packet forwarding at runtime:

# sysctl net.ipv4.ip_forward=1
Tip: To enable packet forwarding selectively for a specific interface, use sysctl net.ipv4.conf.interface_name.forwarding=1 instead.
Warning: If the system uses systemd-networkd to control the network interfaces, a per-interface setting for IPv4 is not possible, i.e. systemd logic propagates any configured forwarding into a global (for all interfaces) setting for IPv4. The advised work-around is to use a firewall to forbid forwarding again on selective interfaces. See the systemd.network(5) manual page for more information. The IPForward=kernel semantics introduced in a previous systemd release 220/221 to honor kernel settings does not apply anymore.[1] [2]

Edit /etc/sysctl.d/30-ipforward.conf to make the previous change persistent after a reboot for all interfaces:

/etc/sysctl.d/30-ipforward.conf
net.ipv4.ip_forward=1
net.ipv6.conf.default.forwarding=1
net.ipv6.conf.all.forwarding=1

Afterwards it is advisable to double-check forwarding is enabled as required after a reboot.

Enable NAT

Install the package iptables from the official repositories. Use iptables to enable NAT:

# iptables -t nat -A POSTROUTING -o internet0 -j MASQUERADE
# iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i net0 -o internet0 -j ACCEPT
Note: Of course, this also works with a mobile broadband connection (usually called ppp0 on routing PC).

Read the iptables article for more information (especially saving the rule and applying it automatically on boot). There is also an excellent guide on iptables Simple stateful firewall.

Assigning IP addresses to the client PC(s)

If you are planning to regularly have several machines using the internet shared by this machine, then is a good idea to install a DHCP server, such as dhcpd or dnsmasq. Then configure a DHCP client (e.g. dhcpcd) on every client PC.

Tango-edit-clear.pngThis article or section needs language, wiki syntax or style improvements.Tango-edit-clear.png

Reason: This is not an iptables guide. Expanding the chain with iptables -I might skip other important rules; if you need to script an ON/OFF switch for this, use custom chain with a jump placed carefully in the INPUT chain. (Discuss in Talk:Internet sharing#)

Incoming connections to UDP port 67 has to be allowed for DHCP server. It also necessary to allow incoming connections to UDP/TCP port 53 for DNS requests.

# iptables -I INPUT -p udp --dport 67 -i net0 -j ACCEPT
# iptables -I INPUT -p udp --dport 53 -s 192.168.123.0/24 -j ACCEPT
# iptables -I INPUT -p tcp --dport 53 -s 192.168.123.0/24 -j ACCEPT

If you are not planing to use this setup regularly, you can manually add an IP to each client instead.

Manually adding an IP

Instead of using DHCP, on each client PC, add an IP address and the default route:

# ip addr add 192.168.123.201/24 dev eth0  # arbitrary address, first three blocks must match the address from above
# ip link set up dev eth0
# ip route add default via 192.168.123.100 dev eth0   # same address as in the beginning

Configure a DNS server for each client, see resolv.conf for details.

That's it. The client PC should now have Internet.

Troubleshooting

If you are able to connect the two PCs but cannot send data (for example, if the client PC makes a DHCP request to the server PC, the server PC receives the request and offers an IP to the client, but the client does not accept it, timing out instead), check that you do not have other Iptables rules interfering.

See also