Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to forward (route) broadcast packets from several wireless clients to a single server in the fixed network. The wireless and fixed network are not bridged for security reasons.

With the following lines the packets show up in the INPUT chain log

iptables -I INPUT -i $IF_WIFI -p udp --dport 6000 -j LOG --log-prefix "I " 
iptables -I FORWARD -i $IF_WIFI -p udp --dport 6000 -j LOG --log-prefix "F "

Now I add the following rule

iptables -t nat -A PREROUTING -p udp -d --dport 6000 -j DNAT --to

Now the packets won't show up either in the INPUT or the FORWARD log and do not get routed to the fixed network. I would expect to see the packet in the FORWARD log

The PREROUTING rule gets hit according to

iptables -t nat -v --list

Chain PREROUTING (policy ACCEPT 466 packets, 28575 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  404 25819 DNAT       udp  --  any    any     anywhere        udp dpt:6000 to: 

(update) IP forwarding is enabled

# cat /proc/sys/net/ipv4/ip_forward 

Have I overlooked something?

share|improve this question
It's been a while since I've tried this, but there were some difficulties. You can route broadcast packages, but things get tricky, for instance where do you send the response? You need to broadcast the response. BTW, perhaps you want to use --match addrtype BROADCAST. – Halfgaar Jun 3 '11 at 9:43
Can you post the output of iptables-save and ip route show ? – pepoluan Aug 18 '11 at 9:07

The simpler solution is to configure a bridge, but use ebtables instead of iptables to enforce the "only broadcast packets may traverse the bridge" rule. You'd want to set the FORWARD policy to DROP and then use a rule like:

ebtables -A FORWARD -s FF:FF:FF:FF:FF:FF -j DROP

This would have the same effect, but should work around the difficulties you're seeing.

(I'm not actually convinced that allowing broadcast only is much more secure than allowing everything to pass, regardless of how you implement it)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.