Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm new on CentOS. I have a CentOS 6.4 system having 2 NIC cards. I want to setup a gateway so I can get internet from public ip over 1st nic card (eth1) and forward the network over 2nd nic card (eth2) so it can be accessible to my local network. I made a DNS server in same system. my gateway system is able to ping to both DNS and google but my client systems are not.

I tried to set the iptables rules it works ping to local gateway but unable to ping to public DNS and from client system..when I ping to said that host is unreachable.

How can I implement this, please help me?

  • public ip is(eth1) : x.x.x.x
  • my local network is (eth2) : 192.168.x.x

I used this for setting up iptables:

iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface eth2 -j ACCEPT

echo 1 > /proc/sys/net/ipv4/ip_forward

Routing table:

Kernel IP routing table
Destination          Gateway             Genmask           Flags     Metric      Ref    Use Iface
local ip             U        0          0        0 eth2
public ip            U        0          0        0 eth1         my local gateway             UG       0          0        0 eth2


Chain PREROUTING (policy ACCEPT 9761 packets, 1239K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 14666 packets, 1001K bytes)
 pkts bytes target     prot opt in     out     source               destination
  345 41722 MASQUERADE  all  --  *      Auto_eth1  

Chain OUTPUT (policy ACCEPT 15011 packets, 1043K bytes)
 pkts bytes target     prot opt in     out     source               destination

Please tell me what are changes I have to do in configuration.

share|improve this question
Show output of the # iptables -L -v -n and # iptables -t nat -L -v -n – ALex_hha Sep 10 '13 at 11:00
Have you considered using a Firewall Distribution that's built on CentOS, with a pretty GUI to make things easier to configure? – Chris S Sep 10 '13 at 16:06
Welcome to serverfault. always try to provides as much information as possible when asking question: distro you are running, your configuration, what have you done so far, what is goal etc – GioMac Sep 19 '13 at 11:31
up vote 1 down vote accepted
ip route del default
ip route add default via INTERNETGATEWAY dev eth2

There is something screwy with your route. the centos 'NAT' box needs to sit on two nets:

192.168.5.x/24 (Private eth2)
192.168.6.x/24 (Public eth1)  -- hypothetically

your route should be something like:

ip route add route dev eth2
ip route add route dev eth1
ip route add default via dev eth1

Right now you are routing internet bound traffic out of your private facing NIC...

share|improve this answer
Thanks lVIlint67, – Rahul Sep 11 '13 at 10:02
Thanks lVlint67, but in this case which DNS address i preferred to use according to my network.can i use public DNS or my private DNS for eth1 and eth2. – Rahul Sep 11 '13 at 10:17
List what ever nameservers you want in /etc/resolv.conf. Your issue though is with your routing table and specifically your default route. – Daniel Widrick Sep 11 '13 at 13:17

Don't reinvent the wheel. Ditch trying to roll it by hand and use an appliance product such as pfSense that handles this very well.

Yes, it is possible, but if you're not familiar with how this all works it's not worth your time to try to build it by hand.

share|improve this answer

To setup PBR (Policy Base Routing) you could use the following script




/sbin/ip route add $P1_NET dev $IF1 src $IP1 table ISP1
/sbin/ip route add default via $GW1 table ISP1

/sbin/ip route add $P2_NET dev $IF2 src $IP2 table ISP2
/sbin/ip route add default via $GW2 table ISP2

/sbin/ip rule add from $IP1 table ISP1
/sbin/ip rule add from $IP2 table ISP2

/sbin/ip route add default via $GW1
/sbin/ip route flush cache

Note: before running the script you must create tables ISP1/ISP2

# echo "10 ISP1" >> /etc/iproute2/rt_tables
# echo "20 ISP2" >> /etc/iproute2/rt_tables

Mark necessary packets

# iptables -t mangle -I PREROUTING -s -m conntrack --ctorigdst -j MARK --set-mark 0x1

# iptables -t mangle -I PREROUTING -s -m conntrack --ctorigdst yyy.yyy.yyy.yyy -j MARK --set-mark 0x2

Setting up own routes for each of ISP

# ip ru add fwmark 0x1 lookup ISP1 prio 1000
# ip ru add fwmark 0x2 lookup ISP2 prio 2000

where is and yyy.yyy.yyy.yyy your public ip addresses

Disable Reverse Path Filter

# echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.