It's also possible to use the Ethernet connection on the Raspberry Pi for the downstream network instead of a WiFi access point. In this configuration, the Pi connects to an upstream network via either WiFi or Ethernet, and bridges that connection to a downstream device connected via Ethernet. 

Upstream Ethernet to Downstream Ethernet

This process is essentially the same as setting up the network bridge documented on the previous page, so it's a good idea to read that page even if you don't intend to use a WiFi hotspot for the downstream network.

First create the bridge.

sudo nmcli connection add type bridge con-name 'Bridge' ifname bridge0

sudo nmcli connection add type bridge con-name 'Bridge' ifname bridge0

Then create two more Ethernet connections with the bridge configured as their master. The following commands will create two more connections named "BuiltinEthernet" and "USBEthernet" so that it's easy to tell which one is which from the nmcli con show output list.

sudo nmcli connection add type ethernet slave-type bridge con-name 'BuiltinEthernet' ifname eth0 master bridge0

sudo nmcli connection add type ethernet slave-type bridge con-name 'USBEthernet' ifname eth1 master bridge0

sudo nmcli connection add type ethernet slave-type bridge con-name 'BuiltinEthernet' ifname eth0 master bridge0

sudo nmcli connection add type ethernet slave-type bridge con-name 'USBEthernet' ifname eth1 master bridge0

Now bring everything down and back up again to activate the connections.

sudo nmcli con down BuiltinEthernet
sudo nmcli con down USBEthernet
sudo nmcli con down Bridge

sudo nmcli con up BuiltinEthernet
sudo nmcli con up USBEthernet
sudo nmcli con up Bridge

sudo nmcli con down BuiltinEthernet
sudo nmcli con down USBEthernet
sudo nmcli con down Bridge

sudo nmcli con up BuiltinEthernet
sudo nmcli con up USBEthernet
sudo nmcli con up Bridge

Once everything is back up, the Pi will pass traffic between the upstream network and downstream connected device.

Upstream WiFi to Downstream Ethernet

Sharing an upstream WiFi connection with a downstream Ethernet connection is a little bit tricky because most WiFi networks do not support the modes necessary to accept directly bridged Ethernet traffic. It's possible to achieve the similar result, but it requires additional steps. Instead of using a bridge you'll have to set up a few more utilities to handle DHCP and forward traffic across the networks.

Install the required utilities with this command.

sudo apt install dnsmasq iptables iptables-persistent

sudo apt install dnsmasq iptables iptables-persistent

Connect to the upstream WiFi network if you haven't already.

sudo nmcli device wifi connect <Network SSID> password <Network Password>

sudo nmcli device wifi connect <Network SSID> password <Network Password>

Create an Ethernet connection with a static IP for the downstream subnet.

sudo nmcli con add type ethernet ifname eth0 con-name BuiltinEthernet ipv4.method manual ipv4.addresses 192.168.50.1/24 ipv4.never-default yes

sudo nmcli con add type ethernet ifname eth0 con-name BuiltinEthernet ipv4.method manual ipv4.addresses 192.168.50.1/24 ipv4.never-default yes

Bring the new Ethernet connection up.

sudo nmcli con up BuiltinEthernet

sudo nmcli con up BuiltinEthernet

Enable IP forwarding with this command:

sudo sysctl -w net.ipv4.ip_forward=1

sudo sysctl -w net.ipv4.ip_forward=1

To make the IP forwarding configuration persistent, you will need to create a service and enable it with the following commands. Do this if you intend to keep using the Pi this way, but if you just want to experiment temporarily, then skip it.

sudo tee /etc/systemd/system/ip-forward.service << 'EOF'
[Unit]
Description=Enable IP forwarding
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/sbin/sysctl -w net.ipv4.ip_forward=1
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable ip-forward.service

sudo tee /etc/systemd/system/ip-forward.service << 'EOF'
[Unit]
Description=Enable IP forwarding
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/sbin/sysctl -w net.ipv4.ip_forward=1
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable ip-forward.service

Set up NAT with the iptables utility.

sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

sudo iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT
sudo iptables -A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

If you want the iptables settings to persist across reboots, run this command:

sudo netfilter-persistent save

sudo netfilter-persistent save

The next step is to set up a DNS server to run on eth0 using the dnsmasq utility.

Open the dnsmasq configuration file with nano or your preferred text editor.

sudo nano /etc/dnsmasq.conf

sudo nano /etc/dnsmasq.conf

Paste the following into the file at the top above the comments to configure the DHCP server.

interface=eth0
dhcp-range=192.168.50.50,192.168.50.150,255.255.255.0,24h
dhcp-option=option:router,192.168.50.1
dhcp-option=option:dns-server,192.168.50.1

interface=eth0
dhcp-range=192.168.50.50,192.168.50.150,255.255.255.0,24h
dhcp-option=option:router,192.168.50.1
dhcp-option=option:dns-server,192.168.50.1

Save the file by pressing ctrl-S then exit nano with ctrl-X.

Lastly restart the server and enable it to run automatically as a service.

sudo systemctl restart dnsmasq
sudo systemctl enable dnsmasq

sudo systemctl restart dnsmasq
sudo systemctl enable dnsmasq

Now when you connect a downstream device to the Pi's Ethernet port, it will get assigned an IP like 192.168.50.X where X is in the range of 50 to 150. The downstream device will have access to the internet through the upstream WiFi network.