Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Centos server with three NIC cards.

ETH0 Public IP xx.xx.xx.xx1/xx.xx.xx.xx2 (with two public IP)

EHT1 Local Subnet (DHCP server listening on this interface)

ETH2 Local Subnet ( Connected to printers/file servers/other lans only accessible inside the organisation.

My Setup requirement:- on ETH1 (192.168.800/24 subnet) I have few users who needs to access Internet and their mails. We have setup a mail server inside subnet itself so that mail access should be faster for the users.

I have enabled static NAT to mail server which has got public IP xx.xx.xx.xx2. Rest users on eth1 see their public IP as xx.xx.xx.xx1 since we have enabled DNAT for it too.

File servers/Printers are accessible by the users on subnet

I have another subnet which needs to communicate to subnet and similarly needs to communicate to is connected to using L3 switch. is connected to using L3 switch.

Everything works fine but unable to make communication b/w to vis and vis.

Whenever I do traceroute from to network it goes to internet.

* * *
* * * ISP default gateway IP

How can I enable forwarding or routing for traffic originating from subnet and destined to should go via eth2 ( so that above traceroute should be appear something like below and rest should work as it is working now.

* * *
* * *

I don't have any clue what needs to be done now.

My NAT rules:

-A PREROUTING -d xx.xx.xx.xx2/32 -i eth0 -j DNAT --to-destination
-A POSTROUTING -s -o eth0 -j SNAT --to-source xx.xx.xx.xx2
-A POSTROUTING -s -o eth0 -j SNAT --to-source xx.xx.xx.xx1


 route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
115.xx.xx.200 U     0      0        0 eth0   U     0      0        0 eth1   U     0      0        0 eth2       U     0      0        0 eth0         115.xx.xx.137         UG    0      0        0 eth0
share|improve this question
If you could add some scheme it would be great – ALex_hha Sep 10 '13 at 8:51
@Alex: I am not sure what you mean by scheme. I have added some more details in question. Let me know if you need any specific information. – Pratap Sep 10 '13 at 8:56
I mean some network map – ALex_hha Sep 10 '13 at 10:35
I am not too good with designing such maps but here is the link – Pratap Sep 10 '13 at 11:43
up vote 0 down vote accepted

Somewhere you have to have gateway, which is connected to the network and which connected network too. Say, that this gateway have IP address

Then you have to add this route on your linux router:

ip ro add via

Because your router is gateway for network too (although through one hop), you don't need add route for on the gateway of network


To make this route permanently on the CentOS, you have to add this line to the /etc/sysconfig/network-scripts/route-eth2 file: via dev eth2

You can see this deployment guide.

share|improve this answer
@ Jan: I added this route and testing it, so far it works fine from 192.168.80 subnet. We are in process to perform some other check from 192.168.70 subnet. I have another silly question how to make this route persistent I followed instruction on [Link]URL(…) but /etc/sysconfig/network-scripts/route-eth2: line 1: No such file or directory. Where should i need to add this entry? – Pratap Sep 10 '13 at 10:06
@PratapSingh I've added information about permanent route... – Jan Marek Oct 2 '13 at 8:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.