Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an internal machine , say X (not connected to internet) that is connected to a machine, say Y which is connected to the internet .

How should I configure the machines to be able to route from internal machine X to internet through Y?

share|improve this question
what OS ? tagged "iptables", so one can assume linux, but want to be sure... – petrus Aug 17 '11 at 22:10
Ah and maybe X isn't connected to the internet for security reasons. It could be a bad idea to route on Y... – petrus Aug 17 '11 at 22:15
@petrus: If it should be secure, than dual-homing of Y just made all your security go with the drain – Hubert Kario Aug 17 '11 at 22:28
up vote 5 down vote accepted

The default router Y uses must know that the network X uses is available through Y.

so, if X is at, Y is at and Then at the router (let's say at, connected to Internet) that shares connection with Y you need to add:

ip route add via scope global

and appropriate rules to firewall to let traffic through.

The other solution is to use SNAT in Y:

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

(assuming that the network between Y and Y's default router is connected to eth0)

In both cases you need to add packet forwarding to Y:

echo 1 > /proc/sys/net/ipv4/ip_forward
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
share|improve this answer
+1. I'd say that SNAT is the way to go. – petrus Aug 17 '11 at 22:16
MASQUERADE isn't actually SNAT and is in fact inferior to SNAT. In simple terms; if your WAN IP is dynamically assigned, you should use MASQUERADE, if not, use SNAT. Why? because if the physical connection goes down, MASQUERADE causes all connections to be forgotten, SNAT doesn't. – Olipro Aug 17 '11 at 22:31
@Olipro: MASQUERADE both is and isn't SNAT, SNAT is far more flexible, at the same time requires explicit configuration. If your external IP changes then using MASQUERADE will save you at least a few headaches. Everything depends on the specific use case. – Hubert Kario Aug 17 '11 at 22:34

Set the gateway on machine X as Y. Then make sure host Y allows packet-forwarding. On linux with iptables this would require more or less this:

Edit /etc/sysctl.conf to allow forwarding, make sure net.ipv4.ip_forward has been set to 1.

After that, apply a rule in iptables to allow the traffic.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

(if eth0 is the right device)

share|improve this answer

Try this.

sysctl -w net.ipv4.ip_forward=1

On machine X, set the default route to be Y.

If that works, permanently set it by adding

net.ipv4.ip_forward = 1

to: /etc/sysctl.conf

and restarting.

share|improve this answer
I'm assuming that Y is behind a router, you haven't actually said that. Or is Y a firewall ? – Matt Aug 17 '11 at 22:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.