To route internet traffic from internal network interfaces like enp2s0 and enp3s0 through a primary external interface enp1s0, you must enable IP forwarding and configure iptables NAT rules. This setup transforms your Linux machine into a router, allowing devices on the internal networks to access the outside world by masquerading their source addresses as the public IP of enp1s0.
Prerequisites for Routing
Before configuring firewall rules, ensure that the kernel is permitted to forward packets between interfaces. By default, most Linux distributions disable this feature for security reasons. You can check the current status by reading the sysctl parameter net.ipv4.ip_forward. If the value is 0, forwarding is disabled. To enable it temporarily, use the command echo 1 > /proc/sys/net/ipv4/ip_forward. For a permanent change, edit the file /etc/sysctl.conf or create a drop-in file in /etc/sysctl.d/ and set net.ipv4.ip_forward=1. Apply the changes immediately using sysctl -p. Without this step, no amount of iptables configuration will allow traffic to pass between interfaces.
Configuring NAT Rules
The core mechanism for sharing an internet connection is Network Address Translation (NAT). Specifically, you need to Masquerade outgoing traffic from the internal interfaces so that replies are correctly routed back to your Linux box. The internal interfaces enp2s0 and enp3s0 should have static or DHCP-assigned IPs on private subnets, such as 192.168.1.0/24 and 192.168.2.0/24 respectively. The external interface enp1s0 holds the public IP assigned by your ISP.
You must add rules to the POSTROUTING chain of the nat table. This chain processes packets after routing decisions have been made, which is exactly when you want to modify the source address. Run the following commands to enable masquerading for both internal networks:
iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o enp1s0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o enp1s0 -j MASQUERADE
The first rule applies to all traffic leaving via enp1s0, while the subsequent rules explicitly target the specific source networks. In many cases, the single generic rule is sufficient, but being explicit helps with debugging and auditing. If you prefer to use SNAT instead of MASQUERADE because your public IP is static, replace MASQUERADE with SNAT --to-source YOUR_PUBLIC_IP. However, MASQUERADE is generally safer for dynamic IPs provided by ISPs.
Handling Forwarding Policies
NAT alone is not enough; you must also permit the traffic to flow through the filter table. The default policy for the FORWARD chain is often DROP or REJECT. You need to explicitly allow established connections and new connections originating from your internal networks. Add these rules to the filter table:
iptables -A FORWARD -i enp1s0 -o enp2s0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i enp1s0 -o enp3s0 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i enp2s0 -o enp1s0 -j ACCEPT
iptables -A FORWARD -i enp3s0 -o enp1s0 -j ACCEPT
The first two lines allow return traffic from the internet back to your internal clients. The last two lines allow new outbound traffic from the internal NICs to the internet. Note that we do not need to explicitly allow new inbound traffic from enp1s0 to enp2s0/enp3s0 if you only intend to provide outbound internet access. If you need to host services internally, you would add additional rules for specific ports.
For more details on managing connectivity issues, see
Troubleshooting Home Network Connectivity Issues on Linux Computer.
Verification and Testing
Once the rules are in place, verify that they are active by running iptables -t nat -L -n -v and iptables -L FORWARD -n -v. Check the byte counters to ensure packets are being matched. From a client machine connected to enp2s0 or enp3s0, ensure the default gateway is set to the IP address of your Linux router on that specific subnet. Test connectivity by pinging an external IP address like 8.8.8.8. If ping works but web browsing fails, check DNS resolution. You may need to configure dnsmasq or forward DNS queries to your ISP's servers via iptables REDIRECT rules.
It is crucial to understand that iptables rules are processed in order. If you have a preceding rule that drops traffic, your NAT and forward rules will never be reached. Always insert new rules at the appropriate position using -I instead of -A if necessary. Also, remember that these rules are lost upon reboot unless saved. Use tools like iptables-persistent or your distribution's equivalent to save the current rule set to disk.
Regarding security, this configuration exposes your internal networks to the internet indirectly. While NAT provides a basic level of isolation, it is not a substitute for a proper firewall. Ensure that your internal hosts are secured against direct attacks. If you suspect malicious activity, you might need to block specific MAC addresses or IPs. For guidance on blocking unwanted sources, refer to
Block MAC Address with Iptables During Attack.
Frequently Asked Questions
Why can my internal clients ping the internet but not browse websites?
This usually indicates a DNS resolution failure rather than a routing issue. Since ICMP ping uses raw sockets and bypasses standard port handling, it often works even when UDP DNS queries are blocked. Ensure your internal clients are configured with valid DNS server addresses, or add iptables rules to redirect DNS traffic to a local resolver or upstream DNS provider.
Does enabling IP forwarding expose my Linux system to attacks?
Enabling forwarding allows traffic to pass through your machine, but it does not automatically open incoming ports to the internet. However, if you misconfigure FORWARD rules to accept all traffic, attackers could potentially reach your internal networks. Always restrict FORWARD rules to only necessary traffic and keep your kernel updated to patch any networking vulnerabilities.
What happens to my iptables rules after a reboot?
By default, iptables rules are stored in memory and are lost when the system restarts. To persist them, you must save the current ruleset to a configuration file. On Debian-based systems, you can install iptables-persistent to handle this automatically during package installation or service restarts.
Can I use SNAT instead of MASQUERADE for better performance?
Yes, if your external interface enp1s0 has a static public IP address, SNAT is slightly more efficient than MASQUERADE because it does not need to look up the current IP of the interface for every packet. Replace the MASQUERADE target with SNAT --to-source your_static_public_ip. If your IP changes frequently, stick with MASQUERADE to avoid broken connections.
How do I troubleshoot if packets are not being forwarded?
First, verify that net.ipv4.ip_forward is set to 1. Second, check the FORWARD chain policies in the filter table to ensure they are not dropping traffic. Third, use tcpdump on both the internal and external interfaces to see if packets are arriving and leaving as expected. Finally, review the log output of iptables to identify which rule is matching or dropping the packets.