Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a given machine I have got two interfaces eth0 and eth1. Cisco routers are connected, to both interfaces, eth0 and eth1 and I want OSPF packets which arrives on eth0 to be forwarded to eth1 and vice versa (see image below).

I have tried issued the following commands:

iptables -A FORWARD -i eth1 -o eth0
iptables -A FORWARD -i eth0 -o eth1

But that did not work. Moreover, I wish this forwarding rule to apply on OSPF packets only, filtering packets by source and destination address and perhaps, even by protocol if possible. OSPF packets are appeared to be


from one direction, and


from the other.


share|improve this question
up vote 2 down vote accepted

[In your question it is not clear to me if the linux box is acting as a bridge/layer 2 or as a layer 3 device, so I'm assuming the later.]

The OSPF Hello packets configured for a broadcast multiple-access network (i.e. ethernet) additionally to being sent to the multicast IP address of are also sent to the multicast layer 2 ethernet MAC address of 01:00:5e:00:00:05. So unless your linux box is configured to bridge eth1 and eth0, the OSPF Hello packets will not make it across your firewall and the OSPF neighbor adjacencies will not be formed.

Then you have this other issue that the TTL for an OSPF Hello packet is 1 so it cannot cross layer 3 boundaries without getting expired in transit.

If you really, really want to do this, then you have to explore some other alternatives such as creating a GRE tunnel (an IPSec tunnel will also do the trick) between Router A and B and configure OSPF for a point-to-point link over this tunnel and then of course, allow through the firewall the traffic for the protocol you are using for the tunnel (i.e. 47 for GRE).

For a good reference on how to configure OSPF over a GRE tunnel take a look at: Configuring a GRE Tunnel over IPsec with OSPF (disregard the IPSec part if you will)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.