Bridge wifi to ethernet to add POE device to network


I need to be able to connect a POE device to my ethernet port and have it identify/register on the wifi network. I have tried various iterations w/ routing and nat, based on this article:

Sharing internet connection from a linux machine over Ethernet

I have been able to connect a device to ethernet and ping other hosts on the wifi network, but I can’t reach the ethernet device from the wifi-network hosts.

Thoughts? Help is appreciated…

Hi, @grh!

Please, add some more information to your question:

  • What operating system are you using? What version? (TorizonCore? Custom?)
  • What carrier board are you using? What version?

And, about your setup:

  • How is assembled your network architecture? Which device with which Operating System is connected to which network or device?
  • How are the IP addresses set up? Which IP and subnet mask for each device?
  • Perhaps a dumb question: can’t you use a router? This would make your life easier :slight_smile:

Also, when you say you can’t reach the device from the wifi, what have you tried? Ping? SSH? TCP or UDP connection using some programming language?

Best regards!

Hi, here’s the info:

Operating system: Linux, based off the tdx-reference-multimedia-image from the tdx-xwayland distro
Carrier board: custom
Network stuff:

So, here’s a summary of the network layout:

-The board is connected to our net via wifi.
-We want to be able to plug a POE device to the ethernet port and have it identify on the network just the same as plugging it into the router directly
-I can “bridge” the ethernet and wifi interfaces using forwarding and nat, but that only works one way: I can ping from the ethernet connected device to other connected devices, but not from other connected devices to the ethernet connected device.
-The above is valid only if I subnet the ethernet connected device to the network. When I assign it an IP on the net, I can’t ping in either direction, either to or from.

Hope this helps.


Hi @grh

Sorry for the delay.

If I understood correctly, you want to bidirectionally bridge both of the module’s network interfaces.

Doing some tests I came to this: you need POSTROUTING rules, FORWARD rules, enabling IP forwarding and route configurations.

Let’s say the enp4s0 is the module’s interface connected to another device (the POE device in your case, let’s say a network, where the module has IP and the wlan0 is the module’s interface connected to your wifi network ( as in your case, supposing IP for the module).

I assume your wifi network already has a DHCP server, which gives an IP for the wifi interface. I also assume that you have correctly set the IP for the cabled devices.

We need to make these rules on the module (ref: askubuntu):

# Allow traffic to be forwarded from wlan0 to enp4s0
sudo iptables -A FORWARD -i wlan0 -j ACCEPT
# Allow traffic to be forwarded from enp4s0 to wlan0
sudo iptables -A FORWARD -i enp4s0 -j ACCEPT

And, also on the module:

sudo iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -o wlo1 -j MASQUERADE

We also need IP forwarding on the module (ref: enable IP forwarding on developer):

sudo sysctl -w net.ipv4.ip_forward=1

Then we need to set the route for the devices:

Those on the ethernet side (which will communicate through module’s enp4s0 interface) need to have the module’s enp4s0’s IP as route

sudo ip route add default via

Those on the wifi side (which will communicate through module’s wlan0 interface) need to have the module’s wlan0’s IP as route

sudo ip route add default via

This worked for me both when testing on a module and on notebooks.

I suppose that what is missing for you are these routings.

Let me know if this works for you.

Ok, sorry for the delay, but have now been able to turn my attention to this finally! It worked, sort of. I needed a bit of tweaking, and I have some follow-on items that I am not sure are possible, but I will ask anyway. Here is a summary of my findings:

1- I created the following setup:

module->has IP on the net via wifi interface mlan0

ethernet-> manually assigned IP, and has interface eth0

2- I ran the following steps according to your answer above:

On the module->

$ iptables -A FORWARD -i mlan0 -j ACCEPT
$ iptables -A FORWARD -i eth0 -j ACCEPT
$ iptables -t nat -A POSTROUTING -o mlan0 -j MASQUERADE
$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
$ sysctl -w net.ipv4.ip_forward=1

3- I manually assigned an IP of to my ethernet-connected device, with a default gateway of (module’s eth0 IP), and then connected it to the module’s ethernet port

4- On a separate device connected to the wifi network, I found that if I added the default route in the way you suggested, I lost any other routing for normal network operations (i.e., if I wanted to search Google for something, the new default route “overrode” the normal default route?) In any case, I deleted your default route and added the following route instead:

$ sudo ip route add to via

Doing the above, and I am successfully able to ping the ethernet connected device at from another wifi device on the net. However, a few things I noticed:

5- On the ethernet connected device, I can only ping to the net. I cannot reach anywhere outside that net, say to the larger Internet, etc. This is true whether or not I assign a route or not, whether or not I have the DNS servers configured properly or not, etc. Clearly I’m missing something there…

6- Is there a way to automate all this in a way that I don’t have to manually assign a route or IP on the wifi side of things for each subnet on each module? I’d like to get to the point where I can just “plug and play”…

7- How about if I don’t want to subnet off the ethernet port? Perhaps I want it so that when I connected my ethernet device, it becomes part of the same network that the wifi devices are on?

@henrique.tx A further note:

I believe it should be possible to do what I want using a combination of ip / iw commands. However, this requires that WDS mode (i.e, 4addr) be set on the wifi card. Something like this:

$ iw dev mlan0 set 4addr on
$ ip link add br0 type bridge
$ ip link set eth0 master br0
$ ip link set mlan0 master br0

When I do this, it cannot set 4addr mode on for the wifi card:

$ iw dev mlan0 set 4addr on
command failed: Operation not supported (-95)

I think this is required to be able to add the mlan0 interface to the bridge. As it stand now, I get the following when I attempt to do so:

$ ip link set mlan0 master br0
Error: Device does not allow enslaving to a bridge.


Hi @grh,

unfortunately not all cards or perhaps just drivers support 4addr. Old rtl8187 seems supporting it, mt7601u seems supporting it as well. The rest of cards I tried don’t support 4addr.

THIS looks promising for the rest of the WiFi cards.

Hi @grh,

I tried parprouted way. It’s working very well. Here list of URL’s I found:

and the best one

Yocto seems not providing parprouted. Git sources I used are these

git clone

git clone

dhcp-helper works well. parprouted requires some patching. First of all it expects /bin/ip and we have it at /sbin/ip. And the second, it defines some struct which conflicts with new kernel? headers. See attached.

As I said it works very well, except that parprouted takes ages to shutdown. Some fixing is required. Perhaps there’s well maintained GIT for it.

arp.c and parprouted.c diffs

Hi @grh

About 5:
The default route kicks in only if the package can not be sent through the other routes.

About 6:
You can try to set your DHCP server (if it is a Linux machine) to give a route to the requesting device. Take a look at the Options section from dhcp man page

About 7:
You can try to use dhcrelay, which allows the DHCP requests to “flow through” Linux.

@henrique.tx @Edward ,

We ended up taking a different to accomplish almost the same thing: we utilized port forwarding from wifi to the ethernet subnet. So, for a wifi device with IP, that has an ethernet subnet of, we fired up a udhcp daemon on the wifi device, plugged in an ethernet device (say IP, and then created port forwarding rules. For example, a request over wifi to the wifi device at might get forwarded to the ethernet device with address

Crude, but it works, and I think is simpler?

This won’t equal to bridge. Forwarding each possible port of one client IP to each possible port of “fake IP”…
Just compiling and launching parprouted + dhcp-helper isn’t difficult. Creating 1 or 2 systemd services isn’t difficult either. In result you get fully functional WiFi STA to ethernet bridge (actually router, since traceroute will list that “bridge” as a forwarding node). Solution is nice since it will work with any AP your STA may need to connect, not all AP’s and WiFi routers support WDS and even STA 4addr mode.