Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up firewall rules and even though I thought I understood netfilter and iptables, I am confused about what exactly happens when you set 1 to net.ipv4.ip_forward and make a MASQUERADE rule.

Does enbaling forwarding mean that every incoming IP packet is basically retransmitted and sent according to the routing table? Or does it simply sent it out on all network interfaces?

The MASQUERADE rule is postrouting and matches everything sent to the internet interface. This seems to suggest that enabling forwarding sents IP packets to every interface and this MASQ rule does something special (NAT'ing) for the internet interface.

My next question would then be if all incoming traffic to the NAT router is simply transmitted on the LAN interface (albeit with non-working addresses). Does that mean that I need to make special DROP rules in FORWARD to prevent unnecessary trafic from being generated?

And if so, does that in turn mean that for every PREROUTING rule I need another in FORWARD?

edit: as a sidenote: my confusion stems from a task I need to do: I forwarded port 80 to an internal server. This works fine from outside our network, but I can't reach it when I try to connect to the WAN IP from within the network. My rule is:

iptables -t nat -A PREROUTING -d WANIP -p tcp -m tcp --dport 80 -m comment --comment "Forward www to <machine>." -j DNAT --to-destination
share|improve this question

Enabling forwarding allows the machine to route packets to other hosts, and yes, it consults the routing table and only sends it to the correct interface. With forwarding disabled, all packets not destinated to this machine are discarded.

However, there is only a single instance of each table per system, not per-interface tables. So the packets get processed by Netfilter regardless of where they get routed, and you have to filter over the destination interface by hand in the rules.

Masquerading replace the source IP adress with the one of the outgoing interface, so that the request appears to come from the router, and not from the private NATted address. It also keeps track of the connection status, so that when replies arrive they can be directed to the original source host.

DNAT happens in PREROUTING and SNAT/MASQUERADE in POSTROUTING, so all the steps in between (filtering by FORWARD, notably) always sees the effective, "end-to-end" adresses. You have to write your forward rules like NAT was non-existent and your private address space was routable.

Your problem most likey stems from the fact that your FORWARD rules do not allow forwarding from the lan to the lan (which would be reasonable in the absence of that kind of internal NATting). Since DNAT happens before FORWARD, when FORWARD looks at it, the destination address has already been changed to the lan one.

share|improve this answer
My confusion about forward rules was not the cause of the problem, because the policy for FORWARD is ACCEPT. I was just kind of wondering how dangerous it is to have it not on DROP. I mean, nothing gets forwarded for which there is no DNAT rule or when it's not ESTABLISHED or RELATED anyway... As for the actual problem, I solved that. I will update my post. – Halfgaar Jul 23 '10 at 12:19
up vote 0 down vote accepted

I solved the problem. In short, it’s because the reply the machine your connecting to makes, goes back to the LAN IP directly, and not back through the router. This article explains it well.

Aside from the rule above, I made this rule to fix it:

iptables -t nat -A POSTROUTING -p tcp --source --dest --dport 80 -j SNAT --to-source is the router, is the machine to which it's forwarded.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.