Planning the Network Configuration

No matter which type of Internet connection sharing you set up on your Pi, you might need to determine the range of IP addresses to allocate to clients. If you are using your Pi as an access point, you don’t need to configure this setting, because the Pi is not used as a router or DHCP server. However, if you are using your Pi to share a wireless connection via an Ethernet port and switch with a separate network, you will need to assign a range of IP addresses that are not the same as those assigned by the existing DHCP and router.

For example, if the existing network uses addresses in the 192.168.1.xxx range, the Pi should assign addresses in the 192.168.2.xxx range. The networks will operate separately, but a network bridge enables the newly created 192.168.2.xxx range to connect with the existing network for Internet access.

To share a wired connection wirelessly, you also need to determine the following:

• 802.11 channel to use

• SSID to use

• WPA encryption type

• WPA encryption key/passphrase

To determine the 802.11 channel to use, use a Wi-Fi monitoring app or program. If you use an Android smartphone or tablet, you can use the Wifi Analyzer (Figure 5-1). The best channels to use with a 2.4GHz wireless adapter, such as the ones built into or designed for use with Raspberry Pi, are 1, 6, or 1l, as the other channels overlap with nearby channels.

Figure 5-1. In this example, channel 1 has the lowest level of interference from other wireless networks

The SSID , which identifies your wireless network, can be any word or phrase you like. For best security, use an SSID which does not identify your ISP, your name, your location, or your device :

• Bad SSID: John’sPi_onMainSt_ABC_ISP

• Good SSID: AZ43098

The encryption type, which helps prevent wireless mooching by person or persons unknown, should be WPA2. The only reason to use the older WPA or first-generation, easily hacked WEP is if you are trying to share a connection with devices that should have gone to the boneyard years ago.

Finally, the encryption key should be a good mix of alphanumeric and punctuation characters (up to 60 characters):

• Bad encryption key: MynetworkissafeIhope

• Good encryption key: My-n07w0511#sa4e90-zz

Record the settings you plan to use, and you’re ready to get started. For the configuration examples in this chapter, we will use the following settings. Be sure to change these as required for your network:

• Range of IP addresses to distribute with DHCP: 192.168.2.2-254 (or a subset)

• Static IP address to use for Pi as router: 192.168.2.1/255.255.255.0

• SSID: Some_Random_Name

• Encryption for wireless: WPA2

• WPA2 passphrase (key): T32t-1P@00Y

• 802.11n channel : 1

Sharing a Wireless Connection Using an Ethernet Port and Switch

If you want to create a separate network that can still access the Internet, you can share a Raspberry Pi’s wireless network by using its built-in Ethernet port along with an Ethernet switch. Because you are connecting two networks together, you will need to create routing tables on the Pi. The following is based on https://raspberrypi.stackexchange.com/questions/48307/sharing-the-pis-wifi-connection-through-the-ethernet-port . I have added illustrations, comments, and clarifications.

One package needs to be installed:

• dnsmasq

Files to edit :

• /etc/network/interfaces (configures wireless and Ethernet interfaces)

• /etc/dnsmasq.conf (configures dns masquerading)

• /etc/sysctl.conf (enables packet forwarding)

• /etc/iptables (via save commands from command line, not nano; configures IP routing tables)

• /etc/rc.local (restores routing tables)

1. Connect an Ethernet switch to the RPi’s Ethernet port with a standard CAT5e or better cable (not a crossover cable). The Pi’s Ethernet port supports 10/100Mbps Ethernet speeds, so a Fast Ethernet switch is sufficient. However, a Gigabit Ethernet switch (10/100/1000Mbps) is also suitable.

2. Connect a second Ethernet cable between the switch and a PC .

3. Start the RPi and log into it.

4. Enter sudo apt-get update.

5. Enter sudo apt-get install dnsmasq.

6. Use sudo nano /etc/network/interfaces to edit the interfaces file. If you prefer a different editor, substitute it for nano in the commands in this section.

7. Add these lines to the eth0 section:

   allow-hotplug eth0  
   iface eth0 inet static  
       address 192.168.2.1
       netmask 255.255.255.0
       network 192.168.2.0
       broadcast 192.168.2.255

8. Save changes and exit (Ctrl-O, press the Enter key, and Ctrl-X).

9. Move the original dnsmasq.conf file:

   sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.orig  

10. Create and edit a new (blank) version of dnsmasq.conf:

    sudo nano /etc/dnsmasq.conf                        

11. Add the following lines (# indicates an optional comment ; see Figure 5-4):

    

    Figure 5-4. The dnsmasq.conf file after editing

    interface=eth0      # Use interface eth0  
    listen-address=192.168.2.1 # listen on  
    # Bind to the interface to make sure we aren't sending things
    # elsewhere  
    bind-interfaces
    server=8.8.8.8       # Forward DNS requests to Google DNS
    server=8.8.4.4       # Secondary Google DNS server
    domain-needed        # Don't forward short names  
    # Never forward addresses in the nonrouted address spaces.
    bogus-priv
    # Assign IP addresses between 192.168.2.2 and 192.168.2.100 with a
    # 12 hour lease time
    dhcp-range=192.168.2.2,192.168.2.100,12h

12. Save changes and exit (Ctrl-O, press the Enter key, and Ctrl-X).

    Note The original version of this file didn’t include a second DNS server. Having at least two DNS servers is good practice, as the secondary server will be used if the primary server fails.

13. Edit the /etc/sysctl.conf file to enable packet forwarding:

    sudo nano /etc/sysctl.conf                        

14. Remove the # from the beginning of the line containing net.ipv4.ip_forward=1. The line before editing:

    #net.ipv4.ip_forward=1

    The line after editing:

    net.ipv4.ip_forward=1

15. Network address translation (NAT) is used to connect the wireless LAN (wlan0) on the Raspberry Pi with the devices that connect via Ethernet (eth0) and a switch. Use the following command to set up NAT :

    sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE  
    
    sudo iptables -A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT  
    
    sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT  

    Tip  iptables terms and syntax to know

    POSTROUTING: altering packets as they leave

    MASQUERADE: used for network address translation (NAT)

    FORWARD: sending data

    RELATED: new connection from a packet that is associated with an existing connection

    ESTABLISHED: data packet is associated with a connection that has sent and received data

    ACCEPT: packet allowed through

    -j: jumps to specified action (a.k.a. “target”) when packet matches a particular rule

    -t: specifies table name

    -o: outgoing network interface to use for a rule

    -A: appends iptable to end of specified chain of rules

    -m: loads match option module by specified name

    -I: specifies the network interface used for incoming traffic

16. The following command creates a file that saves the rules for reuse:

    sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"                        

17. To enable the rules to be used automatically when the system reboots, edit /etc/rc.local and add iptables-restore < /etc/iptables.ipv4.nat near the end of the file:

    sudo nano /etc/rc.local                        

    End of file before editing:

    exit 0

    End of file after editing:

    iptables-restore < /etc/iptables.ipv4.nat
    exit 0

18. Restart the Raspberry Pi:

    sudo reboot                        

19. After rebooting , you can view the routing tables (Figure 5-5) with route

    

    Figure 5-5. A properly configured routing table . The Raspberry Pi’s wireless (wlan0) connection is using the 192.168.1.x range, while the Ethernet (eth0) connection is usig the 192.168.2.x range.

20. To test the connection, use the PC connected to the second Ethernet cable and run a ping command such as ping 192.168.2.1 (Figure 5-6):

    

    Figure 5-6. A successful ping command receives replies back from the IP address set up on the Raspberry Pi for sharing