In general, routing decisions are not made based on interface specifications (all that comes in at eth3 should be routed out through eth0) but based on the destination address of the IP packet to be routed. If the packet carries an address which has a route through eth0, it will be routed through eth0 (and possibly a gateway specified there).
You would only ever need MASQUERADE or SNAT rules if your networks behind eth0 are not routable where their destination packets are going to. In this case, your POSTROUTING rule with the MASQUERADE target would re-write the outgoing IP packet's source address to the address of eth0 (which obviously would need to be routable or be behind another NAT router). The MASQUERADE target is basically a stateful rule, returning reply packets would get their destination address rewritten based on the maintained port:address mapping table.
You would not need to explicitly state ACCEPT rules in the FORWARD chain for this traffic except when your default FORWARD policy is set to DROP or if you are DROP/REJECT rules in the forward chain which would otherwise filter this kind of traffic. In the latter case, using iptables -A
would not help matters as it would insert the new rules after the DROP/REJECT rules already present in the chain. As rules are evaluated sequentially and the first matching rule with a final packet destiny target (like ACCEPT, DROP or REJECT) ultimately decides the fate of the packet, your ACCEPT rules would never be hit.
Your debugging options:
- use
iptables -L FORWARD -v -n
to see if your ACCEPT rules are being hit (i.e. the packet / byte counters are incrementing) - if they are not, data is not being routed as you think it might be
- add an
iptables -A FORWARD -j LOG
rule before dropping / rejecting packets so any packet going to be rejected would get logged with source/destination, in/out interface, protocol and flag information
- run
tcpdump -v -n -i eth0 host <yourtestinghost>
while inducing traffic (like running a ping) to <yourtestinghost>
on a network reachable through eth0 - see if packets are going out and if the source address is re-written as defined in your NAT/POSTROUTING rule
- take a look at the routing table using
ip route
to see if a valid route to your desired destination network exists via <yourISProuter> dev eth0
and if it is superseded by a more specific route through a different router / interface
cat /proc/sys/net/ipv4/ip_forward
?