Internet sharing

On the server computer, assign a static IPv4 address to the interface connected to the other machines. The first 3 bytes of this address cannot be exactly the same as those of another interface, unless both interfaces have netmasks strictly greater than /24.

# ip link set up dev net0
# ip addr add 192.168.123.100/24 dev net0 # arbitrary address

To have your static IP assigned at boot, you can use a network manager.

Check the current packet forwarding settings:

# sysctl -a | grep forward

You will note that options exist for controlling forwarding per default, per interface, as well as separate options for IPv4/IPv6 per interface.

Enter this command to temporarily enable packet forwarding at runtime:

# sysctl net.ipv4.ip_forward=1

Edit /etc/sysctl.d/30-ipforward.conf to make the previous change persistent after a reboot for all interfaces:

Afterwards it is advisable to double-check forwarding is enabled as required after a reboot.

Install the package. Use iptables to enable NAT:

# iptables -t nat -A POSTROUTING -o internet0 -j MASQUERADE
# iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# iptables -A FORWARD -i net0 -o internet0 -j ACCEPT

Use instead of if you installed docker.

# iptables -t nat -A POSTROUTING -o internet0 -j MASQUERADE
# iptables -I DOCKER-USER 1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# iptables -I DOCKER-USER 2 -i net0 -o internet0 -j ACCEPT

If connected via PPPoE, clamp mss to pmtu in order to prevent fragmentation:

# iptables -t mangle -A FORWARD -o ppp0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Read the iptables article for more information (especially saving the rule and applying it automatically on boot). There is also an excellent guide on iptables Simple stateful firewall.

Install the package. To enable NAT with nftables, you will have to create the chain in a new/existing table:

# nft add table inet nat
# nft add chain inet nat postrouting '{ type nat hook postrouting priority 100 ; }'

After that, you have to masquerade the addresses for :

# nft add rule inet nat postrouting oifname internet0 masquerade

You may want to add some more firewall restrictions on the forwarding (assuming the filter table already exists, like configured in nftables#Server):

# nft add chain inet filter forward '{ type filter hook forward priority 0; policy drop; }'
# nft add rule inet filter forward ct state related,established accept
# nft add rule inet filter forward iifname net0 oifname internet0 accept

You can find more information on NAT in nftables in the nftables Wiki. If you want to make these changes permanent, follow the instructions on nftables

Install the package. firewalld is a firewall daemon which relies on nftables or iptables. First change the firewalld zones of network interfaces:

# firewall-cmd --zone=external --change-interface=internet0 --permanent
# firewall-cmd --zone=internal --change-interface=net0 --permanent

Then add a new policy to let traffic flow between the internal and external zone:

# firewall-cmd --permanent --new-policy int2ext
# firewall-cmd --permanent --policy int2ext --add-ingress-zone internal
# firewall-cmd --permanent --policy int2ext --add-egress-zone external
# firewall-cmd --permanent --policy int2ext --set-target ACCEPT
# firewall-cmd --reload

If you are planning to regularly have several machines using the internet shared by this machine, then is a good idea to install a DHCP server, such as dhcpd or dnsmasq. Then configure a DHCP client (e.g. dhcpcd) on every client PC.

Incoming connections to UDP port 67 has to be allowed for DHCP server. It also necessary to allow incoming connections to UDP/TCP port 53 for DNS requests.

# iptables -I INPUT -p udp --dport 67 -i net0 -j ACCEPT
# iptables -I INPUT -p udp --dport 53 -s 192.168.123.0/24 -j ACCEPT
# iptables -I INPUT -p tcp --dport 53 -s 192.168.123.0/24 -j ACCEPT

If you are not planning to use this setup regularly, you can manually add an IP to each client instead.

Instead of using DHCP, a static IP address and a default route via 192.168.123.100 can also be configured manually. There are many tools available to configure the network accordingly. One prominent example of such a tool is , see Network configuration#Network management. Alternatively, one can use a file, see Systemd-networkd#Wired adapter using a static IP to setup a static IP.

Configure a DNS server for each client, see Domain name resolution for details.

That is it. The client PC should now have Internet.

Symptoms might also include: Clients get when pinging host, gets when pinging devices outside the LAN (that should be forwarded by NAT), DHCP offers not crossing a bridge, ...

It is known that docker may cause these problems. Simply disabling and solves this problem.

docker github issue.