Linux NAT routing on Raspberry Pi with Buildroot


This post documents the kernel modules and other packages required to build an embedded Linux NAT router using buildroot, for Raspberry Pi.

Modify Linux kernel configuration

Invoke make linux-menuconfig in buildroot folder to initiate kernel configuration utility. Select modules shown in the figures below.

Networking Options

Network packet filtering framework

Ensure that the following is enabled under Networking Options

  • Network packet filtering framework (Netfilter)

Core Netfilter Configuration

Ensure that the following are enabled under Core Netfilter Configuration

  • Netfilter connection tracking support
  • Netfilter Xtables support (required for ip_tables)
  • “conntrack” connection tracking match support
  • “state” match support

IP: Netfilter Configuration

Ensure following is enabled under Network packet filtering framework (Netfilter)

  • Advanced netfilter configuration

IPv4 packet filtering and NAT

Ensure the following modules are selected under IP: Netfilter Configuration

  • IPv4 connection tracking support (required for NAT)
  • IP tables support (required for filtering/masq/NAT)
  • Packet filtering
  • IPv4 NAT
    • MASQUERADE target support
    • NETMAP target support
    • REDIRECT target support

Enable other targets if you want to do sophisticated filtering.

Modify Buildroot Configuration

Include iptables utility package shown in the figure below, using the configuration utility invoked by executing make menuconfig. Include tcpdump if you want to sniff network data.

Buildroot iptables

Now, just execute make to build the system, and copy the kernel image and root file system to SD card.

Perform NAT routing

I use the following commands to bring up the network interfaces and setup NAT forwarding. Any packets received on interface eth0 are forwarded to usb0. Only packets for connections already established are forwarded back to eth0. usb0 is a USB CDC ethernet interface of the kind seen in modems.

ifconfig usb0 up
ifconfig eth0 up
dhcpcd
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o usb0 -j MASQUERADE
iptables -A FORWARD -i usb0 -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i eth0 -o usb0 -j ACCEPT

If you get any of the following error messages with iptables, you are probably missing one of the kernel modules mentioned above

iptables v1.4.21: can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
iptables v1.4.21: can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
iptables: No chain/target/match by that name.

If the NAT router is not the default gateway on downstream hosts and routers, you’ll have to setup static routes to relay packets upstream. This can be done using a command such as the following on Mac OS X

sudo route -n add -net 10.0.0.0/8 192.168.2.1

Or, on Linux

route add -net 10.0.0.0/8 gw 192.168.2.1

Finally, a couple of useful commands to troubleshoot IP routing and forwarding.

List all rules in iptables

iptables -L -v

Flush all rules in iptables

iptables --flush

A basic packet sniffer

tcpdump -A -i usb0

List all routes

netstat -nr

5 thoughts on “Linux NAT routing on Raspberry Pi with Buildroot

  1. I would like to learn how to do this but need some pointers on where to begin. I have a raspberry pi but what do I need to put on it in order to run kernel configuration utility? I’ll keep looking for a link introducing buildroot and how to get my PI to this initial state so I can follow the steps for making a linux nat router. thanks in advance for any link suggestions i can follow…

    1. That is a useful resource. You’ll find more information in the Buildroot manual and older posts in this blog. I recommend trying things out with Raspbian before venturing into building your own system with Buildroot. You’ll not want to do the latter on a Raspberry Pi itself though. If at all feasible, builds will be terribly slow. Recommend using a decent Linux laptop or VM.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s