Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Debian Squeeze server (as router and host for virtual servers) with two network cards - eth0 for internet, eth1 for local network. I installed KVM, so I created br0 (eth0, vnet0) and br1 (eth1, vnet1). Now I need to setup local network access on this server but it is not working :( What I should do to have internet access from local network (traffic comming on br1)? Everything works ok except the internet access on lan.

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

If I don't use bridges, such configuration is working (with eth0 isntead of br0).

share|improve this question

The MASQUERADE target is a bit "magic" as it uses the IP set up on the output interface to source-nat the traffic.

You could use the SNAT target with the public IP address in parameter :

iptables -t nat -A POSTROUTING -o br0 --to-source W.X.Y.Z -j SNAT

I you want to use the MASQUERADE target (if your public IP changes for example), you should put the rule on the interface where the public address is setup, eth0 :

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
share|improve this answer
Thanks but I had an error somewhere else because now it is working :) eth0 doesn't have an IP, so there must be br0 as output interface. – Bruce Feb 21 '11 at 19:54
up vote 0 down vote accepted

Hmm, I set up logging in iptables and there was traffic from br1 to br0. Then I checked tcpdump on br0 and all packets from local network were with local IP address. I checked again iptables, added the same iptables command:

iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE

and now it was working... Perhaps I did some other mistake before...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.