Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu linux box that I want to turn into a router. It has 2 NICs, and will sit between i) a cable modem (the internet) and ii) a wireless router (serving an internal network). With this simple setup, I've been able to get some distance, but seem to be tripping up below.

(the net) cable modem   ->  (eth3) ubuntu box (eth1)    ->  linksys wifi router 

[ok] ubuntu dhcp client (using eth3) can connect to modem and surf the net
[ok] ubuntu can statically assign an IP to internal NIC (eth1) with command:

sudo ifconfig eth1 netmask broadcast 

[ok] can install and run DHCP server. Client machines can get IPs and ping ubuntu.

After this, is when things start to go awry:

[x] after a while ubuntu eth3 keeps its IP address, but can no longer connect to the net. Rebooting (calling 'dhclient' again) puts me back online.

[x] ubuntu eth1 either i) loses IP address when a client asks for a new IP lease or ii) gets assigned (the start of the network range in '/etc/dhcp3/dhcpd.conf' - see below). How can I keep this value steady?




ddns-update-style none; 
log-facility local7; 
subnet netmask {
  option domain-name-servers;
  option domain-name "";
  option routers;
  option broadcast-address;
  default-lease-time 600;
  max-lease-time 7200;

[x] I'm having problems making the ubuntu box NAT packets from client machines (eth1) to the net (eth3). I've tried setting up the tables with the below commands (I've also tried reversing the NICs in the commands). '/etc/sysctl.conf' (and corresponding '/proc/sys/net/ipv4/ip_forward') have the expected value of '1'. What's the correct incantation for forwarding packets from eth1 -> eth3 ?

sudo iptables --table nat --append POSTROUTING --out-interface eth3 -j MASQUERADE
sudo iptables --append FORWARD --in-interface eth1 -j ACCEPT

I'm sure there's just some config magic that I'm missing on both these points.

Thanks for any help

share|improve this question
sudo sysctl -w net.ipv4.ip_forward=1 – Ash Palmer Nov 21 '10 at 0:58
Yes, I'm definitely setting this parameter. – Frye Nov 21 '10 at 19:02

Some random hints:

Don't use ifconfig directly to configure your NICs. Instead, put the config into /etc/network/interfaces, e.g.:

auto lo
iface lo inet loopback

auto eth3
iface eth3 inet dhcp

auto eth1
iface eth1 inet static

Your /etc/dhcp3/dhcpd.conf appears to have a typo in the broadcast-address (should be

Your iptables MASQUERADE rule should probably be more specific. It may be matching packets that should not be NAT'ed. I would add a source match for the internal network, like this:

iptables -t nat -A POSTROUTING -s -o eth3 -j MASQUERADE

Your ACCEPT rule on the FORWARD chain should not be needed, provided that the policy on the FORWARD chain is ACCEPT (which is the default).

share|improve this answer
Badda boom, badda bing !! That did it. – Frye Nov 21 '10 at 19:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.