USB Internet: Difference between revisions
→ufw: typo fix |
everything requires root permission |
||
Line 7: | Line 7: | ||
<syntaxhighlight lang="shell-session"> | <syntaxhighlight lang="shell-session"> | ||
# ip route add default via 172.16.42.2 | |||
# echo nameserver 1.1.1.1 > /etc/resolv.conf | |||
</syntaxhighlight> | |||
1.1.1.1 is the DNS server, feel free to change it if you wish. | 1.1.1.1 is the DNS server, feel free to change it if you wish. | ||
To make the configuration persistent after reboot do: | To make the configuration persistent after reboot do: | ||
<syntaxhighlight lang="shell-session"> | <syntaxhighlight lang="shell-session"> | ||
# echo 'ip route add default via 172.16.42.2' > /etc/local.d/usb_internet.start | |||
# chmod +x /etc/local.d/usb_internet.start | |||
# rc-update add local | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Disable it if you plug the USB cable out and want to use WiFi, because it can interfere with routing (packets would try to use the USB networking, even though it's disconnected) | |||
==== On the host machine: ==== | ==== On the host machine: ==== | ||
Line 24: | Line 24: | ||
Fisrt, enable IP forwarding: | Fisrt, enable IP forwarding: | ||
<syntaxhighlight lang="shell-session"> | <syntaxhighlight lang="shell-session"> | ||
# sysctl net.ipv4.ip_forward=1 | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Then follow the instructions according to the distribution or firewall you use. | Then follow the instructions according to the distribution or firewall you use. | ||
Line 31: | Line 31: | ||
<syntaxhighlight lang="shell-session"> | <syntaxhighlight lang="shell-session"> | ||
# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT | |||
# iptables -A FORWARD -s 172.16.42.0/24 -j ACCEPT | |||
# iptables -A POSTROUTING -t nat -j MASQUERADE -s 172.16.42.0/24 | |||
# iptables-save #Save changes | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Line 43: | Line 43: | ||
<syntaxhighlight lang="shell-session"> | <syntaxhighlight lang="shell-session"> | ||
# firewall-cmd --get-active-zone | |||
# nmcli connection modify ethX_other connection.zone external | |||
# nmcli connection modify ethX_to_phone connection.zone internal | |||
# firewall-cmd --get-active-zone | |||
# firewall-cmd --zone=external --add-masquerade | |||
# firewall-cmd --zone=external --list-all | |||
# firewall-cmd --zone=internal --list-all | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Line 57: | Line 57: | ||
<syntaxhighlight lang="shell-session"> | <syntaxhighlight lang="shell-session"> | ||
# nft add table inet nat | |||
# nft 'add chain inet nat postrouting { type nat hook postrouting priority 100 ; }' | |||
# nft add rule inet nat postrouting iifname "usb*" masquerade | |||
</syntaxhighlight> | </syntaxhighlight> | ||
postmarketOS has chain forward configured for USB interfaces by default. If using other distributions or the following lines are missing, add them manually. | postmarketOS has chain forward configured for USB interfaces by default. If using other distributions or the following lines are missing, add them manually. | ||
<syntaxhighlight lang="shell-session"> | <syntaxhighlight lang="shell-session"> | ||
# nft add rule inet filter forward ct state { established, related } accept | |||
# nft add rule inet filter forward iifname "usb*" accept | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Line 99: | Line 99: | ||
Restart <code>ufw</code> to make changes take effect. | Restart <code>ufw</code> to make changes take effect. | ||
<syntaxhighlight lang="shell-session"> | <syntaxhighlight lang="shell-session"> | ||
# ufw disable && ufw enable | |||
</syntaxhighlight> | </syntaxhighlight> | ||
Revision as of 16:57, 28 July 2022
You can enable internet through the USB cable when WiFi doesn't work yet on your device. For this to work you set your host machine as gateway for your phone and let your host machine do network address translation for the phone.
Note: It works in both sides: to share internet from your phone to PC (aka usb tethering), just swap host and phone below and use 172.16.42.1. |
On your phone or guest machine:
ip
is used on the most of recent distros. For legacy commands, use route add default gw 172.16.42.2
.
# ip route add default via 172.16.42.2
# echo nameserver 1.1.1.1 > /etc/resolv.conf
1.1.1.1 is the DNS server, feel free to change it if you wish.
To make the configuration persistent after reboot do:
# echo 'ip route add default via 172.16.42.2' > /etc/local.d/usb_internet.start
# chmod +x /etc/local.d/usb_internet.start
# rc-update add local
Disable it if you plug the USB cable out and want to use WiFi, because it can interfere with routing (packets would try to use the USB networking, even though it's disconnected)
On the host machine:
Fisrt, enable IP forwarding:
# sysctl net.ipv4.ip_forward=1
Then follow the instructions according to the distribution or firewall you use.
iptables (Ubuntu/Arch/Alpine)
# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# iptables -A FORWARD -s 172.16.42.0/24 -j ACCEPT
# iptables -A POSTROUTING -t nat -j MASQUERADE -s 172.16.42.0/24
# iptables-save #Save changes
This will enable IPv4 forwarding on your host machine which basically lets it function as a router. The postrouting command will make the kernel on the host translate the packets between the phone network and your normal network on the host machine.
firewalld (RHEL/CentOS/Fedora/Rocky/SLE/openSUSE)
# firewall-cmd --get-active-zone
# nmcli connection modify ethX_other connection.zone external
# nmcli connection modify ethX_to_phone connection.zone internal
# firewall-cmd --get-active-zone
# firewall-cmd --zone=external --add-masquerade
# firewall-cmd --zone=external --list-all
# firewall-cmd --zone=internal --list-all
Use the --permanent
and --reload
options for a persistent configuration.[1]
nftables (postmarketOS)
# nft add table inet nat
# nft 'add chain inet nat postrouting { type nat hook postrouting priority 100 ; }'
# nft add rule inet nat postrouting iifname "usb*" masquerade
postmarketOS has chain forward configured for USB interfaces by default. If using other distributions or the following lines are missing, add them manually.
# nft add rule inet filter forward ct state { established, related } accept
# nft add rule inet filter forward iifname "usb*" accept
You can now verify the internet connection on your phone by pinging something. If this does not work it means you need to compile the kernel with USB_ETH setting enabled in menuconfig.
ufw
In the file /etc/default/ufw
, change DEFAULT_FORWARD_POLICY
to ACCEPT
.
DEFAULT_FORWARD_POLICY="ACCEPT"
In the file /etc/ufw/sysctl.conf
, uncomment net/ipv4/ip_forward=1
.
net/ipv4/ip_forward=1
#net/ipv6/conf/default/forwarding=1
#net/ipv6/conf/all/forwarding=1
Add the following rule to /etc/ufw/before.rules
BEFORE the *filter
table rules.
# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]
# Forward traffic for 172.16.42.0/24
-A POSTROUTING -j MASQUERADE -s 172.16.42.0/24
# don't delete the 'COMMIT' line or these rules won't be processed
COMMIT
Restart ufw
to make changes take effect.
# ufw disable && ufw enable