Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got three ubuntu maverick machines and an access point. I want to be able to set up the following scenario:

three computers and an access point on one subnet, where one computer is a bridge for a second

The setup is as follows:

  • is an access point
  • is a wireless connection on a laptop to the access point
  • is a wireless connection on computer 2 to the access point
  • is a wired connection on computer 1 to computer 2
  • is a wired connection on computer 2 to computer 1
  • is a wired connection on computer 2 to the internet
  • is an internet gateway

In this picture, the things I want to be able to do are:

  • ssh from the laptop to computer 1 (without having to ssh to computer 2 first)
  • access the internet from computer 1 (via computer 2, presumably)

I thought I could bridge the wired and wireless connections on computer 2 so all the 192.168.0.* interfaces would appear to be on the same subnet and would all appear to be directly accessible with each other, but I've been playing with brctl (bridge-utils) and /etc/network/interfaces all day and haven't gotten it working.

As for accessing the internet from computer 1 via computer 2, I'm pretty sure I can set up NAT and IP forwarding on computer 2, as per these instructions (I've done it before.), but I've gotten stumped on the bridge and haven't ventured any further.

share|improve this question
up vote 1 down vote accepted

The problem most likely is that your wireless interface on computer2 doesn't support bridging. Here is an explanation of what the reasons could be.

This is a well known issue, and in many cases, Linux cannot provide a solution (in fact, it's unlikely to even work in Windows).

However, there are other solutions to this. They involve using separate network segments and some routing, but they will give you what you want. Essentially you need to set up computer2 as a router. In order for this to work properly, I would recommend using separate subnets on the wired and wireless network segments.

EDIT: Adding subnets to the diagram above to show the solution, as well as a startup script to configure the networking. Script also allows internet from computer 1 via a NAT on computer 2.

network diagram with subnets

ifconfig ${LAN} ${LANIP} netmask up
iptables -F
iptables -t nat -F
iptables -A INPUT -i lo -j ACCEPT
iptables -I INPUT 1 -m state --state NEW -i ${LAN} -j ACCEPT
iptables -I INPUT 1 -m state --state NEW -i ${WAN} -j ACCEPT
iptables -A FORWARD -i ${WAN2} -o ${LAN} -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i ${LAN} -o ${WAN} -j ACCEPT
iptables -A FORWARD -i ${WAN} -o ${LAN} -j ACCEPT
iptables -A FORWARD -i ${LAN} -o ${WAN2} -j ACCEPT
iptables -t nat -A POSTROUTING -o ${WAN2} -j MASQUERADE
iptables -A FORWARD -i ${WAN} -o ${WAN} -j REJECT
iptables -A FORWARD -i ${WAN2} -o ${WAN2} -j REJECT
for file in ${LAN} ${WAN} ${WAN2}; do
  echo "1" > /proc/sys/net/ipv4/conf/${file}/proxy_arp
  echo "1" > /proc/sys/net/ipv4/conf/${file}/forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
share|improve this answer
if i use separate subnets, then i am making a gateway, right? and in that case, i also need to do it without nat/masquerading, so the laptop can "see" computer 1's ip address, right? is it basically just enabling ip forwarding? – Jayen Jun 6 '11 at 23:01
You are making a gateway with NAT/masquerading anyway, since the private addresses in the subnet cannot be routed on the public internet. If you were to use for your wired network (left hand side) and for the wireless (right hand side), then your computer2 would need to route these subnets to each other (which it would do naturally, as they are connected locally, all you need to do is enable ip forwarding). Any traffic going out to the public Internet will require NAT in any case. – wolfgangsz Jun 7 '11 at 8:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.