Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a ubuntu router machine with following network settings:

br0 netmask
br0:1 netmask

I have a pc attached to the br0:1 network with these settings:

ip netmask gateway

This pc should be able to access the host which is on the br0 network of ubuntu router. is the WAN gateway, so how can I make it a gateway for the hosts on network.

I have enabled ip4 forwarding on the ubuntu router.

share|improve this question
up vote 2 down vote accepted

First make sure is the default gateway for and the Ubuntu router allows traffic from the host. On

route add default gw

On the Ubuntu router:

iptables -I FORWARD -i br0:1 -s -j ACCEPT

Then you have two options. You can either SNAT the forwarded traffic on the Ubuntu router, so that sees it as belonging to the router and knows how to return it:

iptables -t nat -I POSTROUTING -s -j SNAT --to

or you can add the following route on the gateway, assuming it's also a Linux host:

route add -net gw

Which tells it how to route the packets back to that network. Of course if the gateway is filtering you will have to add filter rules for the network too:

iptables -I FORWARD -s -j ACCEPT
iptables -t nat -I POSTROUTING -s -j MASQUERADE

Of course these last rules can be improved with more information.

share|improve this answer
Worked amazingly well. I just used your first two iptables rules. – nixnotwin May 8 '11 at 17:08
Glad to hear that! – Eduardo Ivanec May 8 '11 at 17:10
with IPtables would you be able to specify the entire subnet rather than the specific host I.E. iptables -I FORWARD -i br0:1 -s -j ACCEPT ? – HostBits May 8 '11 at 18:19
Yes, you can use CIDR netmasks as well as non-CIDR ones - or – Eduardo Ivanec May 8 '11 at 19:21
I used the whole subnet with the first two iptables rules in my second test. And it worked well too. When I comapred web-page loading speed with the hosts on, it was slightly slower on I pinged from, and some packets were getting lost.Is it because NATing is being done twice? – nixnotwin May 9 '11 at 1:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.