Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a fairly standard network set up with a Cisco router with a bunch of public IP addresses connected to a TMG Server Firewall (For the sake of anonymity lets say the public IP of the TMG server is and the IP of the router is

We are in the process of setting up a branch office and I have succesfully set up another TMG server with a site-2-site VPN over a spare ADSL line we have in order to check everything works before sending it to the new office.

However, I'd like to mimic various network speeds and latencies to work out what size of connection we need in the branch office and so thought I'd put an Ubuntu Server in between the two and us tc to throttle the bandwidth.

Network Description

Our ISP has changed the config on the Cisco router so one of the ports has a / VLAN and I have split this range into two ranges and set up and Ubuntu Box to route between them with

  • two NICS ( / and /
  • enabled port forwarding in /etc/sysctl.conf
  • added some simple config to iptables to log every packet

enter image description here

From the branch firewall and the main firewall I can ping both NIC IP addreses on the Ubuntu Router. And from the Ubuntu Router I can ping everywhere including the 1.1.1.x addresses However I can't ping the two firewalls from each other, its as if the packets aren't being forwarded. I can't seem to "cross" the ubuntu router.

I suspect its the way I've set up the two NICs with masks but am not really a routing expert!

share|improve this question

1 Answer 1

Have you allowed forwarding?

In /etc/sysctl.conf you have to have this uncommented line:


After you uncomment this line, you have to use this command:

sysctl -p /etc/sysctl.conf

And you will need add to the route table record about a 1.1.1.x addresses like that:

ip route add via

Edit1: You have change netmasks on the firewall2 and router between Ubuntu and firewall to be the same as on the second network adapter: and

and and (or 128 on the both end)

On the router you have then set, that network is reachable via

On the firewall2 you have set, that network (it is both networks and is reachable via address

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.