# Proxy two network interfaces - local and an internet connected network

**URL:** <https://forums.balena.io/t/proxy-two-network-interfaces-local-and-an-internet-connected-network/11713>\
**Category:** balenaOS\
**Tags:** docker, network\
**Created:** [May 25, 2019, 2:32pm UTC](https://forums.balena.io/t/proxy-two-network-interfaces-local-and-an-internet-connected-network/11713 "2019-05-25T14:32:06Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![moritz.ulmer](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/moritz.ulmer/32/961_2.png) [@moritz.ulmer](https://forums.balena.io/u/moritz.ulmer)\
**Post date:** [May 25, 2019, 2:32pm UTC](https://forums.balena.io/t/proxy-two-network-interfaces-local-and-an-internet-connected-network/11713/1 "2019-05-25T14:32:06Z")

</div>

In a project I am using a RaspberryPi 3 running balenaOS (resinOS) with two network interfaces. One connects to the internet while the other connects to an internal, non-internet connected WiFi network. The internal network has several IoT devices that are connected via MQTT. This separation is mainly due to security and stability reasons.

It would be useful for some IoT devices to access [pypi.com](http://pypi.com) and the apt repos. Is there a tried and trusted method to realize this as a Docker service or are there other mechanisms that balenaOS offers?

---

<div class="post-metadata">

**Author:** ![jviotti](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/jviotti/32/220_2.png) [@jviotti](https://forums.balena.io/u/jviotti)\
**Post date:** [May 27, 2019, 10:14am UTC](https://forums.balena.io/t/proxy-two-network-interfaces-local-and-an-internet-connected-network/11713/2 "2019-05-27T10:14:41Z")

</div>

Hey there!

Interesting use case! I believe you can setup NetworkManager to share the internet connection from the external interface to the internal network, and maybe configure some ip tables rules to restrict the hosts that the internal devices will be able to access?

Would something like that solve your problem?

---

<div class="post-metadata">

**Author:** ![moritz.ulmer](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/moritz.ulmer/32/961_2.png) [@moritz.ulmer](https://forums.balena.io/u/moritz.ulmer)\
**Post date:** [May 27, 2019, 12:02pm UTC](https://forums.balena.io/t/proxy-two-network-interfaces-local-and-an-internet-connected-network/11713/4 "2019-05-27T12:02:16Z")

</div>

Hi Juan,

that would definitely be a solution. This could be realized with the root console, but do you have an idea how this can be deployed across a fleet?

Best,  
Moritz

---

<div class="post-metadata">

**Author:** ![afitzek](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/afitzek/32/359_2.png) [@afitzek](https://forums.balena.io/u/afitzek)\
**Post date:** [May 27, 2019, 2:08pm UTC](https://forums.balena.io/t/proxy-two-network-interfaces-local-and-an-internet-connected-network/11713/5 "2019-05-27T14:08:54Z")

</div>

Hi,  
You can talk the NM from a container via DBUS, so you can have a script that runs you NM commands on a container, and if you give a container network\_mode: ‘host’, this container can modify the ip tables rules of the host OS. I hope this helps.

Cheers,  
Andreas