repeat between two hostap cards (in single PC)

Depending on your OS, there may be a bridge device you can configure to do this. Look for "br0".

The simplest way to share the connection is probably to just run NAT on your internal networks (wlan1 or even eth0 if you start using that). That's what I do. I have my main machine claim all the addresses my ISP gives me (via an "alias X.X.X.X") in the ifconfig file for the external interface. Then I add these aliased addresses to the pool that NAT may use. In the NAT config file I allow some workstations get their own private address, others get to draw from the available ports at a single IP address.

-wolfgang

I'm using linux and I have already tried to make a wlan0-wlan1 bridge. It doesn't work.

Hmmm...I'm already under one NAT (my provider's NAT). Anyway, I tried to mess with NAT. Here's what I did on my HostAP box: echo 1 > /proc/sys/net/ipv4/ip_forward iptables -F iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -F -t mangle iptables -t mangle -X iptables -F -t nat iptables -t nat -X iptables -X iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT

wlan0 (master AP client) address: 192.168.1.194 (gateway 192.168.1.1) wlan1 (home AP) address: 192.168.230.1 DHCP server with addresses from the same class (192.168.230.x)

#route Destination Gateway Genmask Flags Metric Ref Use Iface

1. I can ping the Internet from HostAP box
2. I can ping the gateway form HostAP box
3. I can ping my home computer connected to wlan1 AP
4. I can ping my wlan1 AP from my home computer
5. I can ping my wlan0 (192.168.1.194) from my home computer
6. I can't ping the gateway (192.168.1.1) from my home computer

Any ideas?

No way. I want wifi only, no ethernet.

Sorry, I can't spot-read iptables yet. I'm still using an openbsd system with "pf" to do the NAT. Hopefully someone else will post their working iptables NAT file to compare to.

Ping may not be a good test. It is very difficult to NAT. There isn't enough information to get the echo-reply back to the sending host in all cases. Echo-request and echo-reply are raw IP without anything like the tcp and udp port numbers to draw on. Tagging the outgoing packet with a unique port and using that port number to decide who should get the packet just isn't possible.

I would test with tcp and if possible sniff the traffic coming out of and going into the internet side of the nat-ing box. See if the nat-ed IP looks right and if you get a reply that gets lost going through the NAT box in the internet->local direction.

Basically a tcpdump or ethereal on each interface should help show what is going on.

-wolfgang

It's working already - I forgot to load iptables module:/. And it appears that I only need to load iptables_nat and use only one iptables rule: iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE