Re: How do I connect my new wifi router (Mi Router 4C)?
On 08/11/2023 20:39, Martin wrote:
Here is output from phone connected to WiFi setup program:
Default gateway: 192.168.231.3
It seems dnsmasq is able to serve reasonable settings with minimal
configuration.
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
ip saddr 192.168.231.0/24 oifname "wlxe8de27a5ab1c" masquerade
You had a rule that was working for you.
I do not see obvious issues with this one besides docker0 instances are
likely inaccessible from the phone.
10:47:52.614642 enp3s0 In IP 192.168.231.243.48257 > 192.168.231.3.53: 29809+ A? www.google.com. (32)
10:47:52.614851 wlxe8de27a5ab1c Out IP 192.168.0.16.34673 > 81.24.247.14.53: 10155+ A? www.google.com. (32)
10:47:52.614902 wlxe8de27a5ab1c Out IP 192.168.0.16.34673 > 81.24.247.44.53: 10155+ A? www.google.com. (32)
10:47:52.791389 wlxe8de27a5ab1c In IP 81.24.247.14.53 > 192.168.0.16.34673: 10155 1/0/0 A 142.251.208.132 (62)
10:47:52.791559 enp3s0 Out IP 192.168.231.3.53 > 192.168.231.243.48257: 29809 1/0/0 A 142.251.208.132 (62)
10:47:52.794704 enp3s0 In IP 192.168.231.243.46639 > 142.251.208.132.80: Flags [S], seq 4183167263, win 29200, options [mss 1460,sackOK,TS val 19413 ecr 0,nop,wscale 6], length 0
10:47:52.846385 enp3s0 In IP 192.168.231.243.46640 > 142.251.208.132.80: Flags [S], seq 1626803236, win 29200, options [mss 1460,sackOK,TS val 19418 ecr 0,nop,wscale 6], length 0
Since packets from wlxe8de27a5ab1c to 142.251.208.132:80 are missed,
perhaps IP forwarding is disabled or there is a blocking forwarding rule
in the firewall. If I am not wrong, masquerading should affect source IP
address of forwarded packets, but not their presence.
Warning: if you have not configured network interfaces for DHCP in dnsmasq
then do it. Otherwise other computers connected to the upstream WiFi link
may receive DHCP leases emitted from wlxe8de27a5ab1c.
Only thing I added to dnsmasq configuration is one line in
/etc/dnsmasq.d/myHomeDHCPrange file:
dhcp-range=192.168.231.241,192.168.231.254,12h
Dnsmasq may be smart enough to not send DHCP leases to interfaces with
addresses inconsistent with the specified range, but I would still limit
interfaces that dnsmasq listens to.
On 08/11/2023 21:30, Anssi Saari wrote:
systemctl start nftables.service
So if you're experimenting, you edit /etc/nftables.conf and after
editing run systemctl restart nftables.service
And be prepared that this command flushes away rules added by docker. It
is a reason why earlier I suggested to create a dedicated file that may
reload specific set of rules using "nft -f".
Current set of rules is more important than state of the service.
Reply to: