Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux box that is routing between two networks X.X.3.0 and X.X.4.0 , I want it to be able to connect these networks to the Internet.

I have read here on the @Kevin's great answer that in order to be able to do so i have to use NAT which means iptables, my server right now doesn't use iptables so I need to find the right command in order to enable that.

my network can be described like this: Internet <-(eth0) Linux Router <-[1](eth1) <--[2](eth2) The eth2 is connected to the Router directly.

The two local networks can talk with each other, but no one can even ping to a public IP address. I have tried to sniff the packets in the Router, when i am issue the ping command to a public IP address on one machine in the .3.x network, but as far as i can tell there is a problem, and it seems to be with an endless ARP requests of the eth0 int about who has the 3.x IP address. It seems that i have to enable on the Router to behave like a NAT too. I have did a search and i couln't figure out the right command that i am need to issue with the iptables, although i have did try the commands that mentioned here and here. I have had to ability to route between the two local networks without using iptables at all, and since i am don't need it i prefer not to use it, unless it's impossibole to do NAT without it (in that case i am prefer iptable that any other program).

to sum up the question: 1. i need to be able that all the three networks would be able to talk to each other. 2. i prefer no use iptables (if that possibole) or any other added program. 3. That's all.


share|improve this question
possible duplicate of linux router setup – MikeyB Nov 24 '11 at 20:04
@MikeyB It is not duplicate because if possible he wants to achieve it without using iptalbes which he has mentioned explicitly. – Sachin Divekar Nov 24 '11 at 20:13
"my server right now doesn't use iptables so I need to find the right command in order to enable that", "I have did a search and i couln't figure out the right command that i am need to issue with the iptables" → I'm pretty sure he means "i prefer to use iptables (if that possible)" – MikeyB Nov 24 '11 at 21:47
up vote 1 down vote accepted

The two local networks can talk to each other means you have ip_forward enabled. If the local networks can not ping public IP address means you need to do masquerading.

Are you able to ping public IP address from this linux box? If no then there must be some other problem. Maybe, you need to setup your router in bridged mode(It's only a guess).

I assume that your linux machine can ping public ip and there is public ip configured on eth0. So your internal network machines can not go outside to the Internet with the private ip address so you need to do natting. Try using iptables because it is pretty much straight forward.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

If you do not have iptables installed on your system. There must be some firewall installed by default. Which distro you are using?

share|improve this answer

Private IP addresses are not valid for Internet use and can not be routed. They can be used locally only.

To enable Internet access, you need to enable IP forwarding which seems to be done from your description. Second, you need to use NATing. Most of the time, your ISP does the NATing for you. This can change dpending on the connection type and assigned IPs.

For the tool, I dont think there is a better tool than iptables to do it under Linux.

share|improve this answer
"Most of the time, your ISP does the NATing for you" You're probably thinking of the case where your DSL modem/cable modem also does NAT. That isn't evident here. – MikeyB Nov 24 '11 at 21:49
"Most of the time, your ISP does the NAT'ing" is a bit vague. You should be a bit more accurate, as it's the routers that some ISP gives out that does the NAT'ing. In many cases you get a modem that acts like a bridge, where you have to plug in your own router to share the connection. – pauska Nov 24 '11 at 21:50

After some research and recommeds from your peopole, i came to conclution that iptable is the best way to do NATing (masqurating), so i did it like the following:

#Flush all of the current iptables settings with:

$>iptables -F and $>iptables -t nat -F

Then try to ping between the local networks, it should work with the defaults of iptables, in case it doesn't type this:

$>iptables -P INPUT ACCEPT

$>iptables -P FORWARD ACCEPT

$>iptables -P OUTPUT ACCEPT

Then issue the command above from @Sachin Divekar (replace the ethX with your interface of the internet connection):

$>iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Test, it should work. Then you should save This settings with:

$>iptables-save > /etc/sysconfig/iptables


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.