Ubuntu as router with netplan & dnsmasq - can't reach websites

Sebastian

12/3/23, 10:54 AM

I have setup Ubuntu 22.04 LTS as a router for the following scenario:

Client (192.168.222.100) <--> Switch <--> Ubuntu Router eth0 (192.168.222.1) <--> Ubuntu Router enx2887ba778049 (192.168.178.111) <--> WAN Router (192.168.178.1) <--> Internet

This is my netplan config:

network:
    ethernets:
        eth0:
            dhcp4: false
        enx2887ba778049:
            dhcp4: true
            optional: true
    bridges:
        br0:
            interfaces:
                - eth0
            addresses:
                - 192.168.222.1/24
            nameservers:
                addresses: [8.8.8.8]
                search: []
            optional: true
    version: 2

This is my dnsmasq config:

port=53

domain-needed
bogus-priv
strict-order

except-interface=enx2887ba778049

expand-hosts
domain=example.com

dhcp-range=192.168.222.50,192.168.222.240,255.255.255.0,24h
dhcp-option=option:router,192.168.222.1
dhcp-option=option:dns-server,192.168.222.1
dhcp-option=option:netmask,255.255.255.0

From my client, web URLs get resolved:

dig google.com        

; <<>> DiG 9.10.6 <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47720
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;google.com.            IN  A

;; ANSWER SECTION:
google.com.     269 IN  A   142.250.74.206

However, the problem is that I cannot reach them:

ping google.com
PING google.com (142.250.74.206): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1

I think I have to do something with iptables, but the following failed:

sudo iptables -t nat -A POSTROUTING -o enx2887ba778049 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Any ideas what I need to do to get from the client to the internet?

149

0 + 4

iptables

networking

router

netplan

dummyuser

12/3/23, 11:53 AM

Hi @Sebastian Can the client ping the WAN Router? I guess no. Please remove the MASQUERADE rule on eth0. This rule is not needed, but I'm not sure this fixes your issue.

Sebastian

12/3/23, 11:59 AM

Thanks. Removing the MASQUERADE did not solve the issue, and as you guessed correctly, the WAN router cannot be pinged from the client.

dummyuser

12/3/23, 12:16 PM

1) ipforwarding should be enabled at more than 1 interface. any way please check `cat /proc/sys/net/ipv4/ip_forward` should be 1. 2) check your iptables rules. reset counter with `iptables -Z` and look at the FORWARD Chain `iptables -xvnL FORWARD`

Sebastian

12/3/23, 12:31 PM

Thanks, the ip_forward thing was it! `/etc/sysctl.conf` --> `net.ipv4.ip_forward=1` I still need `sudo iptables -t nat -A POSTROUTING -o enx2887ba778049 -j MASQUERADE`.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Ubuntu as router with netplan & dnsmasq - can't reach websites

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.