Acess point with ip_forward causes problem to the ethernet

    I am running librelec on my rasberry pi 4 connected on an external router with 192.168.0.1 gateway.

    I have enabled access point so I can use it as a vpn hotspot. I had no intnernet access so I enabled ip_forwading.

    Now If i set ip adress manually my ethernet card stays in ready state no matter if I disonect and reconnect, thats easy solvable with Ip binding so I use dhcp.

    But it still causes problems. The first one is that I have to diconnect and reconnect ethernet (via menu not physically) to get online

    The second one is that it causes interfere to my alexa's tv's wifi. I was playing some music on spotify via alexa and when I was booting it stoped and both tv and alexa dissapeared from spotify for some time. then they came back.

    I mostly dont turn off my pi but some times I need to switch to rasberry OS so I will have to reconnect ethernet.

    Try this in /storage/.config/autostart.sh (I use it to connect the zerotier interface with the ethernet interface), it works very well for me.

    You will have to find out the name of your hotspot interface (use the ifconfig command) and substitute it in <interface>. If eth0 has another name, change it too.

    Code
    # bridge <interface> >>> eth0
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i <interface> -o eth0 -j ACCEPT

    Edited once, last by elonesna (December 20, 2020 at 3:47 PM).

    Quote from elonesna

    Try this in /storage/.config/autostart.sh (I use it to connect the zerotier interface with the ethernet interface), it works very well for me.

    You will have to find out the name of your hotspot interface (use the ifconfig command) and substitute it in <interface>. If eth0 has another name, change it too.

    Code
    # bridge <interface> >>> eth0
echo 1 > /proc/sys/net/ipv4/ip_forward
echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i <interface> -o eth0 -j ACCEPT

    Still the same problem. Also I noticed that I if connect to the vpn I dont have internet access via access point, also I dont find where interface name is

    I understand your complaint but you do not provide any information to diagnose the problem. The analysis of ifconfig and route SSH commands can help you find the solution to your problem. Everything works fine for me and when a target (special IP address) is not reachable I add routing rules (route command), everything is very easy. Remember that forwarding and routing rules remain active until the next reboot. If you write two contradictory rules in the same session, it will never work.

    Edited 4 times, last by elonesna (December 20, 2020 at 4:48 PM).

    Tell me if there are any sensitive information I need to delete. I havent seen my ip in that.

    Also I noticed that my devices get 192.168.1.1 gateway. That seems weird because there is a router with different gateway in the way and rasberry pi is acting as a gateway too. wasnt it supposed to be pi's ip or 192.168.0.1 that is the router's ip(not modem's)? I am very familiar with computers but networking is my weak spot.

    I have not seen sensitive information. You have a lot of interfaces which is normal when docker is installed. That there is more than one gateway is also normal but there will only be one gateway that has an Internet connection, it will be the router.

    If you want to establish a route to the internet for unresolved IP addresses you can write:

    route add -net 0.0.0.0 netmask 0.0.0.0 gw <router-ip>

    Another thing: The interfaces of a device (which can be many) do not see each other, to do this you have to establish forwarding rules (iptables commands). If you want the rules to be absolutely bidirectional you have to remove "iptables -A FORWARD -m conntrack --ctstate RELATED, ESTABLISHED -j ACCEPT" and put instead "iptables -A FORWARD -i eth0 -o <interface> -j ACCEPT ".

    If you have problems with docker services, they can be solved very easily by adding the parameter "--net=host" during the creation of the container, in this case the listening ports of the service can interfere with those of LE.

    More examples:

    Suppose device 192.168.10.12 wants to access device 192.168.20.45. Both domains 192.168.10.0/24 and 192.168.20.0/24 join in a third device with two interfaces and addresses 192.168.10.88 and 192.168.20.98.

    In the device 192.168.10.12, a routing rule must be established "route add -net 192.168.20.0 netmask 255.255.255.0 gw 192.168.10.88". And in the device 192.168.10.88 and 192.168.20.98 we will have to establish forwarding rules to create a bridge between domains.

    Edited 3 times, last by elonesna (December 20, 2020 at 6:24 PM).

    Your device has the address 192.168.0.194 on the eth0 interface whose domain matches the router.

    Your device also has the address 192.168.1.1 on the tether interface.

    Your device knows that the exit route to the internet is 192.168.0.1 because the router told it through dhcp or you told it with the manual address assignment.

    For a device 192.168.1.2 in the 192.168.1.0/24 domain to know how to go to the internet, it will be necessary to establish a route to 192.168.1.1. This is done by manually setting the tether connection parameters (gateway = 192.168.1.1) for the device 192.168.1.2. But this is not enough because it is also necessary to bridge 192.168.1.1. For example like this in the 192.168.1.1 device:

    # bridge tether <-> eth0

    echo 1 > /proc/sys/net/ipv4/ip_forward

    echo 2 > /proc/sys/net/ipv4/conf/all/rp_filter

    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

    iptables -A FORWARD -i eth0 -o tether -j ACCEPT

    iptables -A FORWARD -i tether -o eth0 -j ACCEPT

    Well, the problem was my VPN provider after all, i asked them, they block tethering. Are there any workarounds? My hunch says that bridging ethernet with tether will do the trick right?

    I found this that was bridging my gateway with tether and tether had internet with vpn enabled but it had my normal ip. Can I modify it to pass through vpn?

    I do not understand what the problem is. My question is where do you install the VPN client? If you are installing it on a tether client, for example 192.168.1.2, there should be no problem and you should follow the instructions above. Otherwise, you must repeat the previous steps with the VPN service installed and do an analysis again.

    There is no reason for your VPN provider to block the connection unless it counts the number of connected devices. The provider has no means of knowing if you are using tether or not, it can only count the number of connected devices with the same public IP address.