Jump to content

USB Internet: Difference between revisions

From postmarketOS Wiki
Add tutorials for ufw
Line 69: Line 69:


You can now verify the internet connection on your phone by pinging something. If this does not work it means you need to compile the kernel with USB_ETH setting enabled in menuconfig.
You can now verify the internet connection on your phone by pinging something. If this does not work it means you need to compile the kernel with USB_ETH setting enabled in menuconfig.
===== ufw =====
In the file <code>/etc/default/ufw</code>, change <code>DEFAULT_FORWARD_POLICY</code> to <code>ACCEPT</code>.
<syntaxhighlight lang="ini">
DEFAULT_FORWARD_POLICY="ACCEPT"
</syntaxhighlight>
In the file <code>/etc/ufw/sysctl.conf</code>, uncomment <code>net.ipv4.ip_forward=1</code>.
<syntaxhighlight lang="ini">
net.ipv4.ip_forward=1
#net/ipv6/conf/default/forwarding=1
#net/ipv6/conf/all/forwarding=1
</syntaxhighlight>
Add the following rule to <code>/etc/ufw/before.rules</code> BEFORE the <code>*filter</code> table rules.
<syntaxhighlight lang="ini">
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic for 172.16.42.0/24
-A POSTROUTING -j MASQUERADE -s 172.16.42.0/24
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
</syntaxhighlight>
Restart <code>ufw</code> to make changes take effect.
<syntaxhighlight lang="shell-session">
$ sudo ufw disable && sudo ufw enable
</syntaxhighlight>


== Notes ==
== Notes ==

Revision as of 07:35, 12 April 2022

You can enable internet through the USB cable when WiFi doesn't work yet on your device. For this to work you set your host machine as gateway for your phone and let your host machine do network address translation for the phone.

Note Note: It works in both sides: to share internet from your phone to PC (aka usb tethering), just swap host and phone below and use 172.16.42.1.

On your phone or guest machine:

ip is used on the most of recent distros. For legacy commands, use route add default gw 172.16.42.2.

$ sudo ip route add default via 172.16.42.2
$ echo nameserver 1.1.1.1 | sudo tee /etc/resolv.conf
1.1.1.1 is the DNS server, feel free to change it if you wish.

To make the configuration persistent after reboot do:

$ echo 'ip route add default via 172.16.42.2' | sudo tee /etc/local.d/usb_internet.start
$ sudo chmod +x /etc/local.d/usb_internet.start
$ sudo rc-update add local
$ #disable it if you plug the USB cable out and want to use WiFi, because it can interfere with routing (packets would try to use the USB networking, even though it's disconnected)

On the host machine:

Fisrt, enable IP forwarding:

$ sudo sysctl net.ipv4.ip_forward=1

Then follow the instructions according to the distribution or firewall you use.

iptables (Ubuntu/Arch/Alpine)
$ sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
$ sudo iptables -A FORWARD -s 172.16.42.0/24 -j ACCEPT
$ sudo iptables -A POSTROUTING -t nat -j MASQUERADE -s 172.16.42.0/24
$ sudo iptables-save #Save changes

This will enable IPv4 forwarding on your host machine which basically lets it function as a router. The postrouting command will make the kernel on the host translate the packets between the phone network and your normal network on the host machine.

firewalld (RHEL/CentOS/Fedora/Rocky/SLE/openSUSE)
$ sudo firewall-cmd --get-active-zone 
$ sudo nmcli connection modify ethX_other connection.zone external
$ sudo nmcli connection modify ethX_to_phone connection.zone internal
$ sudo firewall-cmd --get-active-zone 
$ sudo firewall-cmd --zone=external --add-masquerade
$ sudo firewall-cmd --zone=external --list-all
$ sudo firewall-cmd --zone=internal --list-all

Use the --permanent and --reload options for a persistent configuration.[1]

nftables (postmarketOS)
$ sudo nft add table inet nat
$ sudo nft 'add chain inet nat postrouting { type nat hook postrouting priority 100 ; }'
$ sudo nft add rule inet nat postrouting iifname "usb*" masquerade

postmarketOS has chain forward configured for USB interfaces by default. If using other distributions or the following lines are missing, add them manually.

$ sudo nft add rule inet filter forward ct state { established, related } accept
$ sudo nft add rule inet filter forward iifname "usb*" accept

You can now verify the internet connection on your phone by pinging something. If this does not work it means you need to compile the kernel with USB_ETH setting enabled in menuconfig.

ufw

In the file /etc/default/ufw, change DEFAULT_FORWARD_POLICY to ACCEPT.

DEFAULT_FORWARD_POLICY="ACCEPT"

In the file /etc/ufw/sysctl.conf, uncomment net.ipv4.ip_forward=1.

net.ipv4.ip_forward=1
#net/ipv6/conf/default/forwarding=1
#net/ipv6/conf/all/forwarding=1

Add the following rule to /etc/ufw/before.rules BEFORE the *filter table rules.

# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic for 172.16.42.0/24
-A POSTROUTING -j MASQUERADE -s 172.16.42.0/24

# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT

Restart ufw to make changes take effect.

$ sudo ufw disable && sudo ufw enable

Notes