0

To simplify, let's say I got a network with 3 servers (all runnning centos 6.4) in a row:

Internet---FW---LN---PN

FW: firewall
LN: login node
PN: processing node

i can ping from the FW to the world, but not from the LN or the PN.

I have IP FORWARDING enabled AND IPTABLES disabled in the LN:

[root@meta ~]# !1005
cat /proc/sys/net/ipv4/ip_forward 
1


[root@meta ~]# !1014
iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination     

So my questions is: if i have iptables disabled, does the IP forwarding works? or do i need to raise the IPTABLES and write a forward rule?

Thanks -Ricardo

2
  • 3
    You also need routes. What routes have you set up? ip route show Sep 9, 2013 at 16:52
  • Are all these devices supposed to be in the same network? If so, you need to setup bridging. If not, you need to setup routing. Sep 9, 2013 at 18:51

2 Answers 2

2

Yes, in your configuration, assuming your network is routed properly, it should forward correctly. If you can ping FW from LN but not Internet from LN, you need to check your firewall rules on FW and routing rules on LN and FW. Verify that either LN has a public IP address, or your firewall is properly forwarding connections back to LN from the internet and NATing LN's outgoing traffic.

0

If you are using private address spaces (192.168..., 172..., 10....) then you might need to configure NAT. You can do this only with NetFilter aka iptables.

Another solution would be to use an application proxy and no routing.

2
  • You don't need NAT unless you are routing private space to public space and vice versa. Sep 9, 2013 at 17:09
  • Usually, private address spaces are not used for routing. If he needs routing, plus the fact that he is new on this site, and if he is using private address prefixes... Sep 9, 2013 at 17:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .