Network Topology Example

Here is a graph to visualize what this achieves in the simplest case:

Here nic1 might be wlan0 and nic2 might be eth0. The client might be the laptop of a friend to whom you don’t want to give your super-secret WPA key, or with whom you want to share some large files quickly over a cabled connection. The client will have access to subnet 1 and thus the internet via your computer and you will be able to communicate directly with the client.

This setup is obviously unaffected by the addition of peers to subnet 1. To add more clients to subnet 2 a switch could be used if nic2 is a wired interface, for example. If it is a wireless access point then no additional hardware would be needed. Regardless of the physical connections, the configuration is the same and can be used for topologies such as the following example.

DHCP server

A DHCP server will let different systems connect automatically to the subnet without manual network configuration.

• dhcp from [extra]

DNS server

The DNS server is optional. Use one of the following:

• unbound from [community]
• bind from [extra]

idemptables

This is an optional wrapper for iptables to ensure that no duplicate rules are added.

• idemptables

hostapd

If you wish to create a wireless subnet then you will require a wireless access point on nic2.

• hostapd from [community]

DHCP

The following is the dhcpd configuration file that I used:

default-lease-time 600;
max-lease-time 7200;
#authoritative;

option domain-name-servers 10.0.0.100;
option subnet-mask 255.255.255.0;
option routers 10.0.0.100;
subnet 10.0.0.0 netmask 255.255.255.0 {
  range 10.0.0.150 10.0.0.250;
}

This creates a subnet with address 10.0.0.0 and a DHCP and DNS server at 10.0.0.100. If you do not plan to run a local DNS server then change the domain-name-servers setting to a publically available DNS server (e.g. opendns), or grab one from /etc/resolv.conf.

DNS

server:
  #...
  interface: 10.0.0.100
  access-control: 10.0.0.0/24 allow

options {
//...
listen-on { 10.0.0.100; };
allow-recursion { localnets; };

Firewall Settings

Now comes the tricky part if you have a restrictive firewall. If not, you can probably skip most of this except for enabling forwarding.

The following script will make the necessary changes to Netfilter (iptables) to get things running. Note that it makes some assumptions:

• these rules do not overlap with existing rules
• forwarding is disabled by default and should be disabled when the server is brought down

Also note that on my system I actually use idemptables, which is an iptables wrapper that checks for existing rules to avoid appending duplicates to a table and then checks that all matching rules have been removed when deleting them. This is not necessary but it ensures consistency.

#!/bin/bash

function print_usage()
{
  echo "usage: $0 <WAN interface> <subnet interface> <up|down>"
}

if [[ -z $3 ]]
then
  print_usage
  exit 1
else
  wan_nic="$1"
  subnet_nic="$2"
  action="$3"
fi


mask=/24
subnet_ip=10.0.0.0$mask
server_ip=10.0.0.100$mask
iptables=/usr/bin/idemptables
dhcpd_conf=dhcpd.conf
dhcpd_lease=/tmp/dhcpd.lease
dhcpd_pid=/tmp/dhcpd.pid

source launch_subnet.sh

launch_subnet "$action"

launch_subnet.sh

You can find the source here.

Hostapd Configuration Example

The following is a hostapd configuration file that I have successfully used with 300 Mb/s D-Link wireless network card. It should provide a starting point to configure your own wireless access point in conjunction with the settings above. In this case “nic2” would be “wlan0” and “nic1” would be something else (e.g. “eth0”).

interface=wlan0
driver=nl80211
eapol_version=2

ssid=Foonet
#ignore_broadcast_ssid=1
#bridge=br0

#auth_algs=1
wpa=2
wpa_passphrase=foopassphrase
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP

channel=11
# some laptops will only connect if the mode is set to b
#hw_mode=b
hw_mode=g

#wme_enabled=1
wmm_enabled=1
ieee80211n=1
# required for full speed
ht_capab=[HT40+][SHORT-GI-40][DSSS_CCK-40]