UFW

This gist was originally found at https://gist.github.com/kimus/9315140 and modified for my use case.

Install UFW

sudo apt-get install ufw

Enable NAT

In the file /etc/default/ufw change the parameter DEFAULT_FORWARD_POLICY to enable forwarding policy required for NAT.

DEFAULT_FORWARD_POLICY="ACCEPT"

Enable ipv4 IP forwarding in the kernel at /etc/ufw/sysctl.conf to allow tink-stack host to act as a packet router.

net.ipv4.ip_forward=1

Add the following to /etc/ufw/before.rules just before the filter rules.

# NAT table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic through eth0 - Change to match you out-interface
-A POSTROUTING -s 192.168.1.0/24 -o wlp2s0 -j MASQUERADE

# don't delete the 'COMMIT' line or these nat table rules won't be processed
COMMIT

Make sure to allow SSH into the wireless interface so you can still manage the tink-stack.
Allow all traffic on the wired interface since this is where our nodes are that will be provisioned.
These lines are further down in the file.

# Allow all on enp1s0
-A ufw-before-input -i enp1s0 -j ACCEPT
-A ufw-before-output -o enp1s0 -j ACCEPT

# Allow inboud SSH on all interfaces. This is not to be used on public networks!
-A ufw-before-input -p tcp --dport 22 -j ACCEPT

Now enable the changes by restarting ufw.

$ sudo ufw disable && sudo ufw enable