Update: 15 April 2016 – Added information about which IP address to use and assigning static IP addresses for printers and servers
Recently I have needed to find an emergency alternative to my broadband due to the regional wide area network, Digital Region, being shut down, and the ISP Origin making a mess of getting all their cutomers onto ASDL. To get quickly back onto the internet, I have bought an ZTE MF823 4G Mobile Broadband Dongle as supplied by the badly named ‘three’ mobile phone company. As I have my own internal wired network, with multiple computers and ‘things’ there is a need to have something more sophisticated than just plugging the dongle into a single PC.

Here is my recipe for setting up a Raspberry Pi as a router with an ZTE MF283 Dongle. In this setup all the computers are on a wired Ethernet connection using a switch for the network. The Pi has Raspbian Debian Wheezy installed (June 2014) with all the latest updates made. For testing, the dongle is plugged into the USB port via a powered hub, and the Pi connected to a switch with another PC running Linux Mint.
Which IP addresses to use?
In this How-To I am using the IP address range 192.168.2.xxx this is to avoid conflict with the cable router which uses the 192.168.1.xxx range (the DHCP server is switched off on the router). IPv4 addresses are split into three different ranges, the 192.168.xxx.xxx range – 192.168.0.0 to 192.168.255.255 gives a possible 65,536 addresses but for your home it is unlikely you’ll have more than 255 network devices, so we can simplify things by limiting the address range used to 192.168.2.xxx and avoid the troublesome world of subnet masking.
192.168.xxx.xxx is used as its been designated for use on private networks by the Internet Assigned Numbers Authority this is a well established convention and is best practice. Two other IPv4 address ranges are available for larger private networks: 172.16.0.0-172.31.255.255 and 10.0.0.0-10.255.255.255 with 1,048,576 and 16,777,216 available addresses respectively, the most suitable network class should be chosen for your network.
Setup the Dongle
This USB dongle has its own built in dialer so you do not need ppp or wvdial installed, it appears as a USB ethernet device on the Raspberry Pi. You will need a powered USB hub as the dongle can draw more power than the Pi can provide, the symptoms of too much of power being drawn will be the Pi behaving erratically or restarting unexpectedly.
With the dongle plugged in, check that it is recognised by the Pi with lsusb, it can be seen here as ‘ZTE WCDMA Technologies MSM’:
|
1 2 3 4 5 6 7 8 |
$ lsusb Bus 001 Device 002: ID 0424:9512 Standard Microsystems Corp. Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub Bus 001 Device 003: ID 0424:ec00 Standard Microsystems Corp. Bus 001 Device 004: ID 1a40:0201 Terminus Technology Inc. FE 2.1 7-port Hub Bus 001 Device 005: ID 046d:c52e Logitech, Inc. Bus 001 Device 006: ID 1a40:0101 Terminus Technology Inc. 4-Port HUB Bus 001 Device 007: ID 19d2:1405 ZTE WCDMA Technologies MSM |
The device ID is 19d2. and 1405 is the mode, this should be 1405 – CDC ethernet. If it is not, try removing the micro-SD card and rebooting the Pi, the device modes available are:
- 1225 – Default mode. USB Mass Storage Device + CD-ROM + card reader.
- 1403 – Modem mode. RNDIS + Mass Storage Device.
- 1405 – CDC ethernet
- 0016 – Download mode
As the dongle also has a Mass Storage Device the Raspberry may not switch to CDC ethernet. If the mode does not change, try the following with usb-modeswitch:
$ sudo apt-get install usb-modeswitch
$ sudo usb_modeswitch -v 0x19d2 -p 0x1405 -d
I did not have to change the mode as it was correct already, and it didn’t change when I tried setting it as a Mass Storage device, I have not explored this any further.
When first plugged in the dongle was recognised as a ethernet device but it did not obtain an IP address:
|
1 2 3 4 5 6 7 |
$ ifconfig usb0 Link encap:Ethernet HWaddr 36:4b:53:b7:e3:6e UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) |
if this is the case with you, add the following two lines to the end of sudo nano /etc/network/interfaces:
auto usb0
iface usb0 inet dhcp
the dongle provides its own address to the computer. Reboot, and you should see the obtained address:
|
1 2 3 4 5 6 7 |
usb0 Link encap:Ethernet HWaddr 36:4b:53:b7:e3:6e inet addr:192.168.0.185 Bcast:192.168.0.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:40 errors:0 dropped:4 overruns:0 frame:0 TX packets:15 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:4443 (4.3 KiB) TX bytes:1382 (1.3 KiB) |
The address 192.168.0.185 is now the internet address of the computer the dongle always assigns this address, there is also a useful web status page on http://192.168.0.1
Configuring the network
first of all enable ip4 forwarding, edit the file sudo nano /etc/sysctl.conf and uncomment the line:
net.ipv4.ip_forward=1
this will enable forwarding on reboot, you can also enable IP forwarding immediately with:
$ sudo sysctl -w net.ipv4.ip_forward=1
We now need to give the Pi a static IP address on the internal network. Edit sudo nano /etc/network/interfaces so you end up with a file that looks like this:
|
1 2 3 4 5 6 7 8 9 10 |
auto lo iface lo inet loopback auto eth0 iface eth0 inet static address 192.168.2.1 netmask 255.255.255.0 auto usb0 iface usb0 inet dhcp |
this gives the Pi a static IP address of 192.168.2.1.
DHCP
The next stage is to give the other computers on your network an IP address, this is done with a dhcp server:
$ sudo apt-get install isc-dhcp-server
you will need to configure dhcp sudo nano /etc/dhcp/dhcpd.conf, here is mine:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 |
default-lease-time 600; max-lease-time 7200; ddns-update-style none; # If this DHCP server is the official DHCP server for the local # network, the authoritative directive should be uncommented. authoritative; log-facility local7; subnet 192.168.2.0 netmask 255.255.255.0 { range 192.168.2.50 192.168.2.150; option broadcast-address 192.168.2.255; option routers 192.168.2.1; option subnet-mask 255.255.255.0; default-lease-time 600; max-lease-time 7200; option domain-name "fibble.local"; option domain-name-servers 208.67.222.222, 208.67.220.220; interface eth0; } # give your network printer and file server a static IP addresses host printer1 { hardware ethernet 08:00:2b:4c:59:23; fixed-address 192.168.2.45; } host fileserver { hardware ethernet 12:20:cb:3c:32:4d; fixed-address 192.168.2.40; } |
This will assign IP addresses in the range 192.168.2.50 to 192.168.2.150 to any computer connected to your network. I have used Open DNS for the Domain name Servers, if you wish to use google’s use:
option domain-name-servers 8.8.8.8, 8.8.4.4;instead.
I have also given my network printer a static IP address, it is still assigned by the DHCP server but never changes, the same would apply to any file servers and the like, I would assign static devices addresses that are outside your dynamically assigned range. Reboot the Pi and then your test computer.
Your test computer should now have an IP address (192.168.2.51), and the gateway point to the Pi (92.168.2.1):
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 |
$ ifconfig eth0 Link encap:Ethernet HWaddr 2c:6f:63:8c:21:5f inet addr:192.168.2.51 Bcast:192.168.2.255 Mask:255.255.255.0 inet6 addr: fe80::1e6f:65ff:fe89:216f/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:24232 errors:0 dropped:0 overruns:0 frame:0 TX packets:15622 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:15146663 (15.1 MB) TX bytes:2571110 (2.5 MB) $ route Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.2.1 0.0.0.0 UG 0 0 0 eth0 192.168.2.0 * 255.255.255.0 U 1 0 0 eth0 |
Accessing The Internet
The final part is to have the incoming traffic on the the Ethernet port eth0, go out on the dongle usb0. This is achieved with iptables, a firewall and traffic router. Install with:
$ sudo apt-get install iptables
and you need to setup Network Address Translation, NAT and forwarding. This short bash script clears any old settings before applying the new rules:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
#!/bin/bash LAN="eth0" WAN="usb0" # flush tables iptables -F iptables -t nat -F # apply routing iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE iptables -A FORWARD -i $WAN -o $LAN -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i $LAN -o $WAN -j ACCEPT # make ZTE web interface available iptables -t nat -A PREROUTING -p tcp --dport 2525 -j DNAT --to-destination 192.168.0.1:80 |
Where LAN is your internal network, and WAN is the internet. The final line allows you access to the Dongle’s built in web status page from any browser on your internal network, just use: http://192.168.2.1:2525
Save the file in your home directory as ~/ipt.sh, make it executable and run the script.
$ chmod +x ~/ipt.sh
$ sudo ~/ipt.sh
From your test computer, you will now be able to access the internet.
Finally, you now need to have iptables reload when you start the Pi. Export the iptables settings to a file with:
$ sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"
and create a file sudo nano /etc/network/if-up.d/iptables with the following contents:
|
1 2 |
#!/bin/bash /sbin/iptables-restore < /etc/iptables.ipv4.nat |
and make it executable sudo chmod +x /etc/network/if-up.d/iptables
after a reboot you can see your iptables with sudo iptables -L and sudo iptables -t nat -L and you can see web traffic passing through the router with sudo tcpdump -i any -nn port 80.
Adding a Proxy Server
This is optional, but a transparent proxy server and cache may reduce the amount of traffic on your 3G/4G connection, mileage varies and the amount of data cached was less than I thought it would be, I also found that my Humax Freesat box really didn’t like the proxy server and wouldn’t update its TV schedules while it was on. I have used squid3 for this.
sudo apt-get install squid3
Update the squid3 configuration /etc/squid3/squid.conf so it has the following. The original is rather large, so you may want to make a copy and create a new one:
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 |
http_port 3128 transparent refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 acl manager url_regex -i ^cache_object:// +i ^https?://[^/]+/squid-internal-mgr/ acl localnet src 192.168.2.0/24 acl localhost src 127.0.0.1/32 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access allow manager all http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localhost http_access allow localnet http_access deny all cache allow all cache_mem 128 MB cache_dir ufs /var/spool/squid3 5000 16 256 |
then restart squid3
sudo /etc/init.d squid3 restart
add the following iptables rule to redirect all traffic on port 80 to squid3:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3128
you should now be able to watch the web traffic being processed through squid3 with:
sudo tail /var/log/squid3/access.log -f
finish off by exporting your iptables again, so they are reloaded on reboot:
sudo sh -c "iptables-save > /etc/iptables.ipv4.nat"












