Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently the LAN I manage is organized as follows: internal network ( which uses a Linux server as a gateway (internal address on interface br0, external address on interface br1 through NAT; then the network has another gateway ( which through another NAT connects the whole thing to the internet. What I would like to achieve is to configure the Linux server so that the first layer of NAT is no more necessary, so that for example a computer in the network can ping every computer in the network. I deleted this iptables rule: iptables -t nat -A POSTROUTING -o br1 -j SNAT --to-source, but of course now computers on cannot reach the internet; ip forwarding is of course enabled. What's missing here? Thanks

share|improve this question
up vote 4 down vote accepted

You would need to add a route to the network on the external gateway because it has no idea how to reach it.

share|improve this answer
Another way is to make ethernet bridge from linux box. Then all computers will have addresses from – gelraen Feb 26 '11 at 13:08
That is possible but, depending on the goal of the action, might be entirely undesirable. – Sven Feb 26 '11 at 13:11
Unfortunately bridging is not an option, since it is already used for other things and it would result in a mess. I'm not sure adding a route on the external gateway would be enough: currently (with just nat disabled) computers cannot even ping the external gateway. – Alberto Feb 26 '11 at 13:28
Of course they can't because the external gateway doesn't know how to answer a ping without a route to that network. – Sven Feb 26 '11 at 13:35
Oh, you're right! Thanks – Alberto Feb 26 '11 at 13:53

You have removed the NAT on the server, but have the clients connected to it changed their IP address? They might still have addresses. Each client under the first part of the network needs to either reconfigure their IP settings or (if using DHCP) send a new DHCPOFFER to receive a new IP address.

You may have already done this, but I wanted to check.

share|improve this answer
I don't think he wants to get rid of the 192.168 net altogether, just remove the need for NAT. – Sven Feb 26 '11 at 13:01
The idea was to keep, but removing it is feasible if it doesn't involve bridges (the server is alreadly using bridges to merge wired and wireless networks and that would become a mess). – Alberto Feb 26 '11 at 13:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.