Internet Connection Sharing (ICS) is a networking service that allows one computer with an active internet connection to act as a gateway for other computers or devices on a local area network (LAN). By utilizing a single public IP address, multiple devices can access the web through the host machine. While modern hardware routers have largely superseded this software-based approach for permanent installations, ICS remains a vital tool for ad-hoc networking, emergency connectivity, and specialized lab environments.

What is the core mechanism of Internet Connection Sharing?

At its heart, Internet Connection Sharing is a combination of two critical networking protocols: Network Address Translation (NAT) and Dynamic Host Configuration Protocol (DHCP). When a computer is configured as an ICS host, it ceases to be a mere endpoint and begins to function as a basic router.

The role of Network Address Translation (NAT)

NAT is the technology that makes ICS possible. Most Internet Service Providers (ISPs) provide a single public IPv4 address to a home or business. Without NAT, only one device could use that address at any given time. ICS uses a specific type of NAT often called "Many-to-One" or Port Address Translation (PAT).

When a client device—such as a second laptop connected via an Ethernet cable—requests a website, the ICS host intercepts the packet. It replaces the client’s private IP address with the host's own public IP address and assigns a unique port number to the request. The host maintains a translation table to remember which internal device requested which external resource. When the data returns from the internet, the host uses that table to forward the packet back to the correct client.

The role of Dynamic Host Configuration Protocol (DHCP)

For devices to communicate on a local network, they need IP addresses. Instead of requiring users to manually assign static IPs to every connected device, the ICS service includes a simplified DHCP server.

In a Windows environment, once ICS is enabled, the host automatically assigns itself a static IP (traditionally 192.168.137.1). It then listens for DHCP requests from other devices on the LAN and assigns them addresses within the same subnet (e.g., 192.168.137.x). This automation ensures that "plug-and-play" connectivity is maintained even without a dedicated hardware router.

Implementing Internet Connection Sharing on Windows Systems

Windows has included ICS as a built-in feature since the era of Windows 98 Second Edition. While the interface has evolved, the underlying service—named "Shared Access"—remains remarkably consistent.

How to enable ICS in Windows 10 and 11

To set up sharing, the host computer must have two network interfaces: one for the internet source (WAN) and one for the local distribution (LAN).

  1. Open the Control Panel and navigate to Network and Sharing Center.
  2. Select Change adapter settings.
  3. Right-click the connection that has internet access (e.g., your Ethernet or Wi-Fi adapter) and select Properties.
  4. Switch to the Sharing tab.
  5. Check the box labeled "Allow other network users to connect through this computer's Internet connection."
  6. In the dropdown menu, select the network adapter that will provide the connection to the other devices.
  7. Click OK.

Understanding the 192.168.137.x subnet

A common point of confusion for users is why their local IP addresses change after enabling ICS. Windows specifically reserves the 192.168.137.0/24 subnet for ICS. If your existing network already uses this range, you may encounter address conflicts. In our testing, attempting to manually change the ICS host IP via the registry can lead to service instability, as many Windows system components expect the default 137.1 gateway address.

Advanced Internet Sharing in Linux Environments

For power users and system administrators, Linux offers a more granular and powerful approach to internet sharing. Unlike the "all-in-one" checkbox in Windows, Linux requires the manual orchestration of the kernel, firewall, and routing tables.

Enabling IP Forwarding at the Kernel Level

By default, most Linux distributions disable packet forwarding for security reasons. To allow a Linux machine to act as a gateway, you must modify the kernel parameters. This is done via sysctl.

To check the current status, run: sysctl net.ipv4.ip_forward

If the value is 0, forwarding is disabled. To enable it temporarily, use: sudo sysctl -w net.ipv4.ip_forward=1

For a persistent change that survives a reboot, you must add net.ipv4.ip_forward = 1 to the /etc/sysctl.conf file. This tells the Linux kernel that it is allowed to take a packet arriving on one interface and send it out through another.

Configuring NAT with Iptables and Nftables

Once forwarding is enabled, you must configure the firewall to handle NAT. Using iptables, the command is typically: sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

In this scenario, eth0 is the interface connected to the internet. The MASQUERADE target is a specialized form of NAT that automatically handles dynamic IP addresses, making it perfect for connections where the public IP might change.

For modern distributions using nftables, the syntax involves creating a nat table and a postrouting chain: