🛠 Routeur Linux : bridge WAN/LAN et forwarding sur le R5S

Objectives

Transform the NanoPi R5S into a Linux router/gateway running Debian or Armbian. The board's network architecture consists of 1× GbE WAN (native GMAC + Realtek RTL8211F PHY) and 2× 2.5 GbE LAN (two PCIe Realtek RTL8125BG controllers). You will enable IPv4 forwarding, create the LAN bridge, configure the IP address, set up NAT masquerading on the WAN interface, and verify actual speeds. On OpenWrt/FriendlyWrt, the equivalent is done via UCI; here it is bare Linux.

Hardware

• NanoPi R5S running Debian/Ubuntu FriendlyElec or Armbian (Armbian renames interfaces wan1/lan1/lan2 via udev; FriendlyElec keeps eth0/eth1/eth2 — check with ip link)
• Internet box on the GbE port (WAN), 2.5G PC on a LAN port
• Console access during network configuration (risk of cutting SSH when configuring WAN/LAN)

Complete code

#!/bin/bash
# routeur_r5s.sh — routeur Linux minimal sur NanoPi R5S (root requis)
set -e
WAN=eth0; LAN=eth1   # adapter : eth0=GbE WAN, eth1/eth2=2,5G LAN

# 1) Forwarding IPv4/IPv6 persistant
cat > /etc/sysctl.d/99-routeur.conf <<'EOF'
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
net.ipv4.conf.all.rp_filter=1
EOF
sysctl --system

# 2) Bridge LAN sur les deux ports 2,5G + IP
ip link add br-lan type bridge
ip link set $LAN master br-lan
ip link set eth2 master br-lan
ip addr add 192.168.69.1/24 dev br-lan
ip link set br-lan up

# 3) WAN en DHCP puis NAT masquerade
dhclient $WAN
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
iptables -A FORWARD -i br-lan -o $WAN -j ACCEPT
iptables -A FORWARD -i $WAN -o br-lan -m state --state RELATED,ESTABLISHED -j ACCEPT

# 4) DHCP simple pour le LAN (installer dnsmasq au préalable)
sudo apt install -y dnsmasq
cp /dev/null /etc/dnsmasq.conf
dnsmasq --interface=br-lan --dhcp-range=192.168.69.50,192.168.69.200,255.255.255.0,12h

Expected verification

ip -br addr shows br-lan at 192.168.69.1 and eth0 via DHCP. A PC on the 2.5G port receives an address in 192.168.69.x and pings 1.1.1.1. ethtool eth1 | grep Speed indicates 2500Mb/s, ethtool eth0 1000Mb/s. iperf3 reference (CNX): ~2.35 Gbps Rx and ~1.85 Gbps Tx per 2.5G port, ~941 Mbps on the GbE. In pure forwarding, the RK3568B2 handles gigabit without difficulty.

Common errors

• Losing SSH when bridging the connection interface: perform the operation via serial/HDMI console or ensure out-of-band access.
• Forgetting sysctl net.ipv4.ip_forward=1: ping leaves the LAN but does not traverse.
• Different interface names depending on the distribution (wan1/lan1/lan2 under Armbian): always check ip link before running scripts.
• Wiring confusion: the native GbE port is WAN; the two 2.5G ports are LAN. Persistent network scripts (systemd-networkd/NetworkManager) may overwrite manual configuration upon reboot.
• Under mainline kernel between 2023 and 2026, fixes for gmac0 (phy-supply, reset pin) were still in progress: a silent WAN may come from an intermediate kernel, update it.