To successfully forward all traffic between two network interfaces on Linux, you must enable IP forwarding in the kernel and configure iptables with NAT rules. The most common failure occurs because the kernel drops packets by default or because return traffic is not masqueraded. This guide provides the exact commands to resolve these issues permanently.
Understanding Kernel-Level Forwarding
Before touching firewall rules, the Linux kernel itself must permit packet routing between interfaces. By default, many distributions disable this feature for security reasons. If you attempt to route packets without enabling this setting, the system will silently drop them regardless of your iptables configuration. You can check the current status by reading the value of
net.ipv4.ip_forward. A value of
0 indicates that forwarding is disabled, while
1 means it is active.
To temporarily enable forwarding for the current session, use the following command:
sysctl -w net.ipv4.ip_forward=1
This change takes effect immediately but will revert after a reboot. To make this persistent across reboots, you need to modify the sysctl configuration file. Open
/etc/sysctl.conf or create a new file in
/etc/sysctl.d/ and add the line
net.ipv4.ip_forward=1. Then apply the changes using
sysctl -p. Without this step, no amount of iptables magic will allow traffic to traverse from one interface to another.
Configuring NAT Rules for Outbound Traffic
Once kernel forwarding is enabled, you must handle Network Address Translation (NAT). When a client on your internal network sends a packet to an external server, the source IP is private (e.g., 192.168.1.x). The external server will reply to that private address, which is unreachable from the public internet. To fix this, you need to masquerade the source address of outgoing packets.
Assuming
eth0 is your internal interface and
eth1 is your external gateway interface, the command looks like this:
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
The
-t nat flag specifies the NAT table. The
POSTROUTING chain is used because we are modifying the packet just before it leaves the system. The
-o eth1 option ensures the rule only applies to traffic exiting via the external interface. The
MASQUERADE target replaces the source IP with the IP address of
eth1. This is dynamic and ideal for DHCP-assigned IPs where the external IP might change. If your external IP is static, you can use
SNAT instead with the
--to-source flag.
For a more comprehensive approach, consider reading
Optimizing Firewall Configuration with Iptables: A Comprehensive Guide, which covers advanced filtering strategies alongside basic NAT.
Allowing Forwarded Packets in the Filter Table
Enabling NAT does not automatically mean the firewall allows the traffic through. The
filter table, which handles standard input, output, and forwarding decisions, often has a default policy of
DROP or
REJECT for the
FORWARD chain. If this chain is restrictive, packets will be dropped even if NAT is correctly configured.
You need to explicitly allow traffic to pass through the router. Use the following command to accept forwarded packets:
iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
This rule accepts traffic coming from the internal interface (
eth0) and going out to the external interface (
eth1). You may also need to allow return traffic:
iptables -A FORWARD -i eth1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT
The
-m state --state ESTABLISHED,RELATED module ensures that only responses to existing connections or related new connections are allowed back into the internal network. This prevents unauthorized incoming connections from bypassing your security posture. For more details on securing specific addresses, see
Block MAC Address with Iptables During Attack.
Troubleshooting Common Issues
If traffic still does not flow, verify your routing table. Run
ip route to ensure that the default gateway points to the correct next-hop address for the external interface. Additionally, check if any other firewall tools like
firewalld or
ufw are interfering. These services often manage their own iptables chains and may override or conflict with manual rules. Disabling them or ensuring they are aware of your custom NAT rules is crucial.
Another frequent issue is DNS resolution. Ensure that clients on the internal network are using a DNS server that is reachable via the forwarded path. If the DNS server is on the same subnet as the external interface, clients might fail to resolve names unless the router forwards UDP port 53 traffic specifically. You can test connectivity using
ping from the internal client to an external IP address. If ping works but web browsing fails, the issue is likely DNS-related rather than a forwarding problem. For broader connectivity diagnostics, refer to
Troubleshooting Home Network Connectivity Issues on Linux Computer.
Finally, save your iptables rules so they survive a restart. On Debian-based systems, install
iptables-persistent and run
dpkg-reconfigure iptables-persistent. On RHEL/CentOS systems, use
service iptables save or
iptables-save > /etc/sysconfig/iptables. Without saving, your configuration will be lost upon reboot, leading to intermittent failures that are difficult to diagnose.
Frequently Asked Questions
Why does ping work but HTTP traffic fail?
This usually indicates a DNS resolution issue rather than a forwarding problem. Since ICMP echo requests do not require domain name resolution, they may succeed while TCP connections to websites fail if the client cannot reach the DNS server. Check the client's resolv.conf settings and ensure UDP port 53 is allowed in your FORWARD chain.
Can I use SNAT instead of MASQUERADE?
Yes, SNAT is suitable if your external interface has a static IP address. MASQUERADE is preferred for dynamic IPs because it queries the interface's current IP at runtime. Using SNAT with a dynamic IP will break connectivity whenever the ISP changes the assigned address.
How do I check if iptables is blocking my traffic?
Use the command
iptables -L -v -n to list all rules with packet counters. Look at the
pkts column in the FORWARD chain to see if packets are being matched and accepted. If the counter is zero, the traffic is either not reaching the chain or is being dropped by a default policy before matching any explicit rules.
Does enabling ip_forward expose my system to attacks?
Enabling forwarding alone does not open ports, but it allows your system to act as a router. Without proper firewall rules, this could allow malicious actors to traverse your network. Always pair ip_forward with strict FORWARD chain policies that only allow established or explicitly permitted traffic.
What happens if I forget to save iptables rules?
All rules will be lost when the system reboots, causing immediate loss of internet access for clients behind the router. You will need to manually re-enter all NAT and filter rules after every restart. Using persistence packages like iptables-persistent automates this process and prevents service interruptions.