.png)
Introduction
Internet
Connection Sharing (ICS) provides the ability for one computer to share
its Internet connection with another computer. To do this, a computer
with an Internet connection must be configured to function as an
Internet gateway. A second computer (or network of computers) connects
to the Internet indirectly via the gateway computer.
Situations in which ICS may be necessary include:
- dial up connection
- authenticated (PPPoA/E) connection
- wireless connection
- When it is impractical (such as with distance) to run multiple network cables to each computer.
GUI Method via Network Manager (Ubuntu 9.10 and up)
In order to
share an Internet connection, the computer that will do the sharing must
have two network cards or ports. This assumes that you are using at
least one Ethernet port and that it is identified as "eth0". eth0 will
be the port that other computers will connect to you on.
When you are logged in:
- Go to "System" on your top bar
- Navigate to "Preferences" and select "Network Connections"
- When that window opens, select "Auto eth0" and press "Edit" (This assumes that you are connected to the internet on some other port, for ex. wlan0 using wireless)
A new
window will open. Navigate to the tab titled "IPv4 Settings" and change
the Method to "Shared to other computers". After restarting the
computer you should now be able to plug in any computer into your other
Ethernet port or share through your wireless card.
Note: To clarify the above example here is an example
configuration that will work - *
1. You are already connected to the internet using your wireless on
port wlan0 * 2. The ethernet
port eth0 is connected to the PC that needs to share your internet
connection (or you could wire eth0 to a router for multiple machines)
Wireless Ad-Hoc connection sharing scenario
Step by step guide:
- dnsmasq-base has to be installed: sudo apt-get install dnsmasq-base
- remove dnsmasq as it's conflicting with NetworkManager: sudo apt-get remove dnsmasq
- restart NetworkManager: sudo /etc/init.d/network-manager restart
- Add a new wireless network with NetworkManager (left-click on NetworkManager icon, then select "Create New Wireless Network")
- Call the new network "UbuntuAdhoc" (note: if you choose another name you will have to turn on connection sharing later by editing the network you just created!)
- Set encryption to "WEP40..." (note: you may have to experiment here according to what type of encryption with ad-hoc the phone/other laptop/pc supports, wpa is not supported)
NetworkManager
now should connect to itself (which means it creates the ad-hoc
wireless network and routes any internet traffic to your wired network
interface). Now connect with the client(s) and you should have a working
internet connection.
Ubuntu Internet Gateway Method (iptables)
You will
need two network cards in the gateway computer, or a PPP interface and a
network card. One network card (or PPP interface) connects to the
internet, we will call this card eth0. The other card connects
to your internal network, we will call this eth1. It is also
possible to do ICS with a single network card. In this case, use eth0
for the internet and eth0:0 for the internal network.
- Internet <<==>> eth0 <> Ubuntu gateway <> eth1 <<==>> Client PC
- Internet <<==>> ppp0 <> Ubuntu gateway <> eth1 <<==>> Client PC
- Internet <<==>> eth0 <> Ubuntu gateway <> eth0:0 <<==>> Client PC
Gateway set up
The
following example will focus on the most common gateway setup; an Ubuntu
computer with two wired network adapters (eth0 and eth1) hosting ICS to
a static internal network configured for the 192.168.0.x subnet.
For this example, eth0 is used to represent the network
card connected to the internet and eth1 represents the network card
connected to a client PC. You can replace eth0 and eth1 as needed for
your situation. Also, any private
IP subnet can be used for the internal network IP addresses.
In summary:
- eth0 = the network adapter with internet (external or WAN).
eth1 = the network adapter to which a second computer is attached (internal or LAN).
192.168.0.x = IP subnet for eth1
Your setup may be
different. If so, make sure to change them accordingly in the following
commands.
Configure internal network card
Configure
your internal network card (eth1) for static IP like so:
sudo ifconfig eth1 192.168.0.1
(The external and
internal network cards cannot be on the same subnet)
Configure NAT
Configure
iptables for NAT translation so packets can be correctly routed through
the Ubuntu gateway.
sudo iptables -A FORWARD -i eth0 -o eth1 -s 192.168.0.0/24 -m conntrack --ctstate NEW -j ACCEPT sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT sudo iptables -A POSTROUTING -t nat -j MASQUERADE
(rule1 allows
forwarded packets (initial ones), rule2 allows forwarding of established
connection packets (and those related to ones that started), rule3 does
the NAT.)
IPtables settings need to be
set-up at each boot (they are not saved automatically), with the
following commands:
- Save the iptables:
sudo iptables-save | sudo tee /etc/iptables.sav
- Edit /etc/rc.local and add the following lines before the "exit 0" line:
iptables-restore < /etc/iptables.sav
Enable routing
- Configure the gateway for routing between two interfaces by enabling IP forwarding:
sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"
- Edit /etc/sysctl.conf and add these lines:
net.ipv4.conf.default.forwarding=1 net.ipv4.conf.all.forwarding=1
The
/etc/sysctl.conf edit is required because of following Bug (Hardy and
later releases) Launchpad
Bug Report
Client set up
Any OS can
connect to the internet as an ICS client as long as networking has been
configured correctly. The following example will focus on how to set up
an Ubuntu ICS client. For this example, it is assumed that the client
is connected to an Ubuntu gateway which has been configured to share ICS
on the 192.168.0.x subnet according to the gateway set up outlined
above.
For this example, eth0 is
the network card on the client which is connected (by crossover cable)
to eth1 on the Ubuntu gateway. You can replace eth0 as needed for your
situation. Also, any private IP subnet can be used for the internal
network IP address, as long as it matches the subnet on the gateway.
Disable networking
sudo /etc/init.d/networking stop
Give the client a static IP address
sudo ifconfig eth0 192.168.0.100
This IP address
can be anything within the gateway's private IP range.
Configure routing
sudo route add default gw 192.168.0.1
This address
should match the IP address on the gateway's internal network card (eth1
in the above example).
Configure DNS servers
Unless your
ICS gateway can also perform DNS, you must
manually configure the client with your ISP DNS servers. If you do not
know your ISP's DNS servers, you can use OpenDNS servers
instead.
- Backup your current /etc/resolve.conf file:
sudo cp /etc/resolv.conf /etc/resolv.conf.backup
- Open /etc/dhcp3/dhclient.conf with your favorite text editor:
sudo nano /etc/dhcp3/dhclient.conf
- Search for the line that starts "prepend domain-name-servers", and change it to look like this:
prepend domain-name-servers 208.67.222.222,208.67.220.220;
208.67.222.222
and 208.67.220.220 are OpenDNS DNS servers. If you wish to use your
ISP's DNS servers, use them here instead of the OpenDNS servers.
Restart networking
sudo /etc/init.d/networking restart
Once this is finished, your client will now have access
to the internet via ICS. Please direct any questions/comments to the Internet
Connection Sharing Documentation thread.
A beginner's working example of a Ubuntu Desktop
with 2 nic cards, sharing internet connection http://ubuntuforums.org/showthread.php?p=3713684
Advanced Gateway Configuration
The above
example outlines how to do basic ICS on a static IP network. Once you
have configured your Ubuntu computers for ICS and confirmed that
everything works across your static network, there are a few advanced
routing configurations which can make it much easier to set up the ICS
client.
Advanced configurations
include DHCP server, and DNS server. A DHCP server allows the client to
get an ip address automatically without having to manually configure a
static IP. A DNS server allows the client to resolve internet host names
without manually configuring DNS addresses.
DHCP/DNS server
This is
deceptively easy, and will be acceptable for most situations. However,
it will not allow the ICS client to see computers on different subnets.
- Install software
sudo aptitude install dnsmasq
- Stop the server
After dnsmasq has been installed, it is automatically
started, so it will need to be stopped before changes can be made.
sudo /etc/init.d/dnsmasq stop
- Make a backup of the well commented configuration file (we won't use any of this, but it's handy to have a copy of for reference later)
sudo cp /etc/dnsmasq.conf /etc/dnsmasq.conf-backup
- Edit /etc/dnsmasq.conf with your favorite text editor and add the following two lines:
interface=eth1 dhcp-range=192.168.0.100,192.168.0.250,72h
Note: The
"interface" should match the interface that your clients are connected
to, and the "dhcp-range" should be within the gateway's private IP
subnet you configured according to the "Gateway set up" directions
above.
- Start the DHCP/DNS server
sudo /etc/init.d/dnsmasq start
Now your clients should be able to pull an automatic ip
address and resolve host names.
Other approaches
The
following section includes a rough outline of some alternative methods
for configuring an ICS gateway. They are incomplete and untested. They
are included simply for the sake of information.
Alternate server software (CLI)
There are
other ways to host ICS, but they are outside the scope of this article.
Alternate NAT
The ipmasq
daemon does NAT routing so you don't have to configure iptables. The
following directions are incomplete and should not be considered a full
description of what needs to be done to configure ipmasq.
sudo aptitude install ipmasq
Configure ipmasq to allow dhcp requests, otherwise you
need to stop ipmasq to make a connection. You need to copy a .rul from
the documentation directory into the /etc config and edit the interface
name. Then reconfigure ipmasq to start after networking has been started
sudo dpkg-reconfigure ipmasq.
Dedicated DHCP server
dhcp3 is an
easy to configure and scalable true DHCP server that can be configured
for many different aplications. dhcp3 configuration is more complex,
but it can be useful in many situations:
Dedicated DNS server
BIND9 is a
popular and well supported local DNS server. It is very versatile, and
very powerful, but difficult to configure correctly:
Alternate gateway software (GUI)
Another
approach --- set up Firestarter, to
run connection sharing, set up dhcp3-server, and set its configuration
to listen to the correct eth*. To change this later, run sudo
dpkg-reconfigure dhcp3-server.
Basically,
you need to have Firestarter active/turned on/protecting, to have the
connection shared.
When you
install dhcp3-server, it will place a sample config file in your
/etc/dhcp3 folder, called dhcpd.conf. I suggest you install dhcp3-server
first, and then firestarter, cause if you are lucky, firestarter will
set up a new config file for dhcp3 for you.
At any time that changes are made to your dhcpd.conf
file, restart the server - sudo /etc/init.d/dhcp3-server restart will do
it. Alternatively, every time
you run the sudo dpkg-reconfigure dhcp3-server, at the end, your
server will restart.
There are
several issues that I had...first of all, the Firestarter firewall won't
even start if you don't have it configured to listen to the right
interface...You can change which one it listens to in Preferences -->
Network Settings. The Local network connected device must be the same
as you have dhcp3-server listening to, of course, both checkboxes under
that need to be checked. The Internet connected network device will be
the one that is configured for Internet. Now, I have two NICs, but I
have pppoe configured on eth0, and I have Internet connection sharing
configured on the same one, cause eth0 is also configured for a static
192.168 internal IP for my internal network.
simple iptables example
simple example wlan0 has the
internet connection eth0 is being used to share the connection it could
be directly with a single pc via a crossover cable or switch or you
could have a router with a cable from eth0 to the wan port and a whole
lan setup behind this. Interestingly the internet connection could be
ppp0 a 3g or mobile Internet modem.
- #!/bin/sh
#
# internet connection sharing wlan0 is the gate way
# eth0 is the lan port this might use a straight ethernet cable to a router wan port or a switch or a single PC
# 192.168.2.2 is the port that is being used by the lan for access I changed it to 192.168.2.254 and set fixed addresses for the wan and router
#
# change wlan0 to ppp0 and you can use this for mobile broadband connection sharing
#
ifconfig eth0 up"
ifconfig eth0 192.168.2.1
echo “1” > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o wlan0 -s 192.168.2.0/24 -j MASQUERADE
iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 3074 -j DNAT --to-destination 192.168.2.2
iptables -t nat -A PREROUTING -i wlan0 -p udp -m multiport --dports 88,3074 -j DNAT --to-destination 192.168.2.2
iptables -A FORWARD -i wlan0 -d 192.168.2.2 -p tcp --dport 3074 -j ACCEPT
iptables -A FORWARD -i wlan0 -d 192.168.2.2 -p udp -m multiport --dports 88,3074 -j ACCEPT
You could use the
above as a bash script changing things to suit
- If things go wrong The Following script should save you if things get badly messed up.
- #!/bin/sh
#
# rc.flush-iptables - Resets iptables to default values.
#
# Copyright (C) 2001 Oskar Andreasson
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; version 2 of the License.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program or from the site that you downloaded it
# from; if not, write to the Free Software Foundation, Inc., 59 Temple
# Place, Suite 330, Boston, MA 02111-1307 USA
#
# Configurations
#
IPTABLES="/usr/sbin/iptables"
#
# reset the default policies in the filter table.
#
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -P OUTPUT ACCEPT
#
# reset the default policies in the nat table.
#
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
#
# reset the default policies in the mangle table.
#
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P POSTROUTING ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT
#
# flush all the rules in the filter and nat tables.
#
$IPTABLES -F
$IPTABLES -t nat -F
$IPTABLES -t mangle -F
#
# erase all chains that's not default in filter and nat table.
#
$IPTABLES -X
$IPTABLES -t nat -X
$IPTABLES -t mangle -X
Further reading https://help.ubuntu.com/community/IptablesHowTo
Internet Connection Sharing
Documentation thread http://ubuntuforums.org/showthread.php?t=503287
See also
-
References : https://help.ubuntu.com/community/Internet/ConnectionSharing
No comments:
Post a Comment