Moving NAT to Raspberry

In an attempt to control even more functions of my home broadband I have decided to use my monitoring Raspberry Pi to execute the NAT function also. For this, I had to have two Ethernet interfaces connected to the monitoring Raspberry Pi and also move all connections currently using the built-in switch to my provider router to a switch behind the monitoring Raspberry Pi executing the NAT function. I could use a USB Ethernet adapter, for example the one I had lying around from my extra Chromecast that Google have send for free with the Stadia controller. But I still needed an extra switch and as a prime day deal I have found this VLAN enabled switch on sale:

https://amzn.eu/53hbzq4

This solves both issues, providing multiple Ethernet interfaces attached to the Raspberry Pi with an 802.1q trunk and also accommodation for the connections previously on the provider router built-in switch.

Enabling a VLAN interface on the Raspberry Pi was straigthforward:

jordana@pi4b2:~ $ sudo apt install vlan

jordana@pi4b2:~ $ sudo nano /etc/network/interfaces.d/vlans

auto eth0.8

iface eth0.8 inet manual

  vlan-raw-device eth0

The corresponding VLAN configuration on the switch is as follows:

Raspberry Pi is connected to port 1 and an Ethernet port on the provider router to port 8.

I changed the provider router to modem mode and moved the default gateway address 192.168.0.1/24 of my home LAN to eth0 on the Raspberry Pi.

jordana@pi4b2:~ $ sudo nano /etc/dhcpcd.conf

interface eth0

static ip_address=192.168.0.1/24

I also had to change the NAT rule as follows (updated with rule to drop connection request from eth0.8):

jordana@pi4b2:~ $ sudo iptables -t nat -I POSTROUTING -o eth0.8 -j MASQUERADE

jordana@pi4b2:~ $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED -i eth0.8 -p tcp -j ACCEPT
jordana@pi4b2:~ $ sudo iptables -A INPUT -i eth0.8 -p tcp -j DROP

jordana@pi4b2:~ $ sudo iptables-save -f /etc/iptables.rules