Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

To simplify, let's say I got a network with 3 servers (all runnning centos 6.4) in a row:


FW: firewall
LN: login node
PN: processing node

i can ping from the FW to the world, but not from the LN or the PN.

I have IP FORWARDING enabled AND IPTABLES disabled in the LN:

[root@meta ~]# !1005
cat /proc/sys/net/ipv4/ip_forward 

[root@meta ~]# !1014
iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination     

So my questions is: if i have iptables disabled, does the IP forwarding works? or do i need to raise the IPTABLES and write a forward rule?

Thanks -Ricardo

share|improve this question
You also need routes. What routes have you set up? ip route show – Michael Hampton Sep 9 '13 at 16:52
Are all these devices supposed to be in the same network? If so, you need to setup bridging. If not, you need to setup routing. – David Schwartz Sep 9 '13 at 18:51

Yes, in your configuration, assuming your network is routed properly, it should forward correctly. If you can ping FW from LN but not Internet from LN, you need to check your firewall rules on FW and routing rules on LN and FW. Verify that either LN has a public IP address, or your firewall is properly forwarding connections back to LN from the internet and NATing LN's outgoing traffic.

share|improve this answer

If you are using private address spaces (192.168..., 172..., 10....) then you might need to configure NAT. You can do this only with NetFilter aka iptables.

Another solution would be to use an application proxy and no routing.

share|improve this answer
You don't need NAT unless you are routing private space to public space and vice versa. – Michael Hampton Sep 9 '13 at 17:09
Usually, private address spaces are not used for routing. If he needs routing, plus the fact that he is new on this site, and if he is using private address prefixes... – Mircea Vutcovici Sep 9 '13 at 17:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.