Internet Sharing using a linux box

If you have an apple and I have an apple and we exchange these apples then you and I will still each have one apple. But if you have an idea and I have an idea and we exchange these ideas, then each of us will have two ideas.

— George Bernard Shaw

 

The computer world was similar to all of us having an apple each till some time back. And then the wise men from the industry made networks. Ideas started flowing all over and soon came in the internet. The internet has been the best thing that has happened to the computer world so far. It has created a platform where we can share our ideas.

Since the Internet is a large network composed of smaller networks, it made sense to break the address space into smaller chunks. Network classes enable us to break down this address space. In IPv4 the various classes of networks are –

Class A networks have an address range  between 1.0.0.1 to 126.255.255.254 and support 16 million hosts on each of 127 networks.
Class B networks have an address range  between  128.1.0.1 to 191.255.255.254 and support 65,000 hosts on each of 16,000 networks.
Class C networks have an address range between  192.0.1.1 to 223.255.254.254 and support 254 hosts on each  of 2 million networks.
Class D networks have an address range between  224.0.0.0 to 239.255.255.255 and are reserved for multicast groups.
Class E  networks have an address range between  240.0.0.0 to 254.255.255.254 and are reserved for the future

Such a system makes things simple and networks are manageable. However, they cannot communicate with each other. The scenario is very similar to how communities grew around the world. With time  people from different communities needed to communicate with each other, however language was the barrier. The solution they found was people who understand both the languages i.e. translators. So if you need to talk to a beautiful French girl, all you need to do is get  somebody who understands French and can translate English to French and vice versa. Routers /gateways do the same in computer networks. Different networks communicate with each other using routers.

router allows hosts that are not on the same logical network, like an IP subnet, to communicate with each other. The router receives packets (chunks of data) on an interface and routes them to where they need to go based on a routing table; the table allows the router to have knowledge of where a given logical network is located.

Most offices and homes have small class C private networks. These networks need to communicate with the servers in the internet. The only logical way for them is to use a gateway/router. Linux has routing functionality in the kernel itself which makes it an ideal choice for as routing box. 

One simple way of sharing the internet connection using linux is using the IP forwarding feature of the kernel and network address translation (NAT). For NATing one can use either ipchains or iptables.  It is assumed that the private network is in the 192.168.1.0-255 range.
Let us take the example of a simple network.  The server is used to connect to the internet. It’s IP address is 192.168.1.1. There are 4 workstations 192.168.1.2-5. They are connected to the server via the switch. All the workstations share the internet through 192.168.1.1

network diagram

The first step is to enable ipforwarding in the kernel of the server (192.168.1.1).

$ vi /etc/sysctl.conf
Change the line
net.ipv4.ip_forward = 0

to
net.ipv4.ip_forward = 1

This would enable ip forwarding.

Then we need to get the server to NAT which can be done via ipchains or iptables. 

If ipchains is used, create a file called rc.fw and add following lines

$ vi /etc/rc.d/init.d/rc.fw

#!/bin/bash

# First Load the ipchains kernel module. Required only if ipchains is compiled as a module.
/sbin/modprobe ipchains
insmod ipchains

# MASQ the full 192.168.1.0/24 network
/sbin/ipchains -A forward -s 192.168.1.0/24 -j MASQ

# List the rules
/sbin/ipchains -L -n

If iptables is used instead of ipchains, create a file called rc.fw and add the following lines –

$ vi /etc/rc.d/init.d/rc.fw

#!/bin/bash

# First Load the ipchains kernel module . Required only if iptables is compiled as a module
/sbin/modprobe iptables
insmod iptables

# MASQ the full  network
/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE

# List the rules
/sbin/iptables -L

This would look after all the entire data traffic from the local network to the internet.

Finally add this to the startup –

$ vi /etc/rc.local
Add the line
/etc/rc.d/init.d/rc.fw
 
This ensures that the settings are retained after a reboot also.

After rebooting the server would do all the routing functions for the entire network.

On the client side all that is required is to set the default router/gateway as the server’s IP i.e.  192.168.1.1. The entire network is now set to share the internet connection.

Note – This article is also published on linuxgazette :)

 

LEAVE A COMMENT