I have a Raspberry Pi running Linux (Raspbian) which is connected to my corporate Internet over an Ethernet cable. The RPi also has a wifi adaptor plugged into a USB port. I've been following along the with Ada Fruit's Raspberry Pi Access Point Tutorial, but there is a snag.I only want to allow connections from the wifi USB adaptor to reach services running on the RPi. I don't want them to be allowed to connect to the corporate network in any way. The RPi is running a service which should be available both over the corporate intranet and over the wifi connection. The RPi must not route any connection between the wifi network and the corporate intranet.My question is, what part of the tutorial should I follow, and should I not follow to make this setup work?
Allow wifi connections only to a local service, don't route to the wired ethernet
linux;networking;wifi;firewall;raspbian
The section you should ignore is the Configure Network Address Translation section. In fact if you want to guarantee that wireless clients can't go onto the Ethernet connection do the following:Run sudo nano /etc/sysctl.conf. Scroll to the bottom and add net.ipv4.ip_forward=0on a new line. Save the file. This will disable ip forwarding on boot up.Run: sudo sh -c echo 0 > /proc/sys/net/ipv4/ip_forwardThis will disable IP forwarding immediately (it should be disabled already). This will guarantee that there is no IP forwarding on your Pi.If you want to go a little further, you can also disable it at the firewall, but adding the following iptables rules.sudo iptables -A FORWARD -i wlan0 -o eth0 -j DENYsudo sh -c iptables-save > /etc/iptables.ipv4.natRun sudo nano /etc/network/interfaces and add up iptables-restore < /etc/iptables.ipv4.nat to the very end. Save and close the file.That should disable all traffic from wireless to the corporate network.For more information about Linux networking options take a look here: https://www.kernel.org/doc/Documentation/sysctl/net.txt