Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have searched a lot with google. It is only documented how to enable IP Forwarding in the linux kernel but not HOW and WHY I have to enable it. I would be thankful for advice.

When and why do I have to enable it? (For example when I install a bridge?, or when using iptables? or when using "route add" ?)

(Good links are appreciated, but I was not able to found one. )

Thank you very much! Jan

share|improve this question

1 Answer 1

up vote 8 down vote accepted

IP forwarding should be enabled when you want the system to act as a router, that is transfer IP packets from one network to another.

In the simplest case, consider a server with two physical ethernet ports which is meant to connect to two different networks (say your internal network and the outside world as provided by a DSL modem). If you just connect and configure those two interfaces, the system can communicate on either network. However, packets from one network cannot travel to the other network, because forwarding is not enabled.

Consider the specific example of 'route add'. If you have two network interfaces, you will add a minimum of two routes, one for each interface. When the kernel considers where to send a network packet, it will pick the most specific applicable route and then send it along to that interface.

However, if forwarding is turned off, the kernel will first check to see which interface the packet came from. If it didn't come from the same interface, the kernel will discard it.

EDIT: First note that you can use a router without having two physical network interfaces. For example if you are using VLANs, your server can transfer IP packets between vlans but only have one physical network interface. This is called a one-armed router. However for the simplest case yes you can say that if you only have one physical network interface then you don't need to enable IP forwarding.

IP forwarding involves transferring packets between network interfaces (real or virtual) so I think that if you had two interfaces on the same network, you would have to enable ip forwarding to allow packets to move between the interfaces. However since the interfaces are already on the same network, it doesn't seem to make a lot of sense to transfer packets between them.

share|improve this answer
    
Basically, if you aren't using the computer as a router, i.e. if you don't have 2 network cards installed, do not enable IP forwarding. –  ultrasawblade Mar 18 '11 at 2:27
    
thanks for the answer: Is it a requirement that the IP packets go over interfaces or is the focus on "go over network boundries", that is also "inter process communication" requires IP Forwarding (if crossing network boundries)? And secondly does this only apply with packets crossing different networks (like xxx.xxx.xxx.xxx/24 and yyy.yyy.yyy.yyy/24) or also with pakets within the same network going from one interface to another? thanks. –  jan Mar 18 '11 at 2:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.