Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux machine (working as a router) with 3 private interface(eth1,eth2,eth3) and 1 public interface(eth0). When packet comes in from interface eth3 it should go out via eth0 and when reply comes back on eth0 it should be redirected to eth3.

By using these rule in iptables.

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth3 -m state  --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth3 -o eth0 -j ACCEPT

Can anyone please point me where i'm making error.

share|improve this question
What behaviour are you seeing. What's the output of cat /proc/sys/net/ipv4/ip_forward? – SmallClanger Jun 5 '12 at 9:39
output is 1 of cat /proc/sys/net/ipv4/ip_forward – Vikas Kumar Jun 5 '12 at 9:47
What's the default route for outbound packets? – SmallClanger Jun 5 '12 at 9:56
i have given default route to another router(in same subnet with eth0). – Vikas Kumar Jun 5 '12 at 10:50

In general, routing decisions are not made based on interface specifications (all that comes in at eth3 should be routed out through eth0) but based on the destination address of the IP packet to be routed. If the packet carries an address which has a route through eth0, it will be routed through eth0 (and possibly a gateway specified there).

You would only ever need MASQUERADE or SNAT rules if your networks behind eth0 are not routable where their destination packets are going to. In this case, your POSTROUTING rule with the MASQUERADE target would re-write the outgoing IP packet's source address to the address of eth0 (which obviously would need to be routable or be behind another NAT router). The MASQUERADE target is basically a stateful rule, returning reply packets would get their destination address rewritten based on the maintained port:address mapping table.

You would not need to explicitly state ACCEPT rules in the FORWARD chain for this traffic except when your default FORWARD policy is set to DROP or if you are DROP/REJECT rules in the forward chain which would otherwise filter this kind of traffic. In the latter case, using iptables -A would not help matters as it would insert the new rules after the DROP/REJECT rules already present in the chain. As rules are evaluated sequentially and the first matching rule with a final packet destiny target (like ACCEPT, DROP or REJECT) ultimately decides the fate of the packet, your ACCEPT rules would never be hit.

Your debugging options:

  • use iptables -L FORWARD -v -n to see if your ACCEPT rules are being hit (i.e. the packet / byte counters are incrementing) - if they are not, data is not being routed as you think it might be
  • add an iptables -A FORWARD -j LOG rule before dropping / rejecting packets so any packet going to be rejected would get logged with source/destination, in/out interface, protocol and flag information
  • run tcpdump -v -n -i eth0 host <yourtestinghost> while inducing traffic (like running a ping) to <yourtestinghost> on a network reachable through eth0 - see if packets are going out and if the source address is re-written as defined in your NAT/POSTROUTING rule
  • take a look at the routing table using ip route to see if a valid route to your desired destination network exists via <yourISProuter> dev eth0 and if it is superseded by a more specific route through a different router / interface
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.