I'm beginning understanding network concepts and tools. I setup three VM's with the following configuration:


In A, I ping and it pongs. I think A has no idea where is located. So, when I ping, it doesn't know to what interface it should be routed. My first question is that when there's only one interface, why it wonders? :D Anyway, for route to take occur, in A I add the following:

sudo route add default enp0s3

I may use the following commands instead:

sudo route add default gw
sudo route add default gw
  1. Am I right in the commands?
  2. The last command also works! Why?! Is it correct?! How?!

With one of these commands A may ping too. Then, I go to ping C from A. I expect the ping packet when received by B, it knows how to route it and route it to C via 192.168.2.x interface, but it doesn't.

  1. Why? Should I do something in B?
  2. What should I do in B for the ping to get response from C?
  • ServerFault is not a suitable place to ask such basic questions, this is a Q&A site about managing information technology systems in a business environment and you’re expected to know your basics. - But if you want “B” to route packets between A & C then it, like any router, must be configured as a router because when it isn’t it won’t route.
    – Bob
    Feb 27, 2021 at 14:05
  • oh sorry. please let me know how to setup such a configuration.
    – hamidi
    Feb 27, 2021 at 14:12
  • i mean just a clue or a link to a document.
    – hamidi
    Feb 27, 2021 at 14:32

2 Answers 2


In order to achieve what you would like to have you need to do:

On A, you need to configure the route to 192.168.2.X, that is via

ip route add via

Note: you can specify a device name with dev DEVICE_NAME or you can omit it in this case.

On B, you need to make sure that packets can be forwarded e.g. ip_forwaring is enabled:

sysctl -w net.ipv4.ip_forward=1


echo 1 > /proc/sys/net/ipv4/ip_forward

In addition, you need to allow the traffic between the two networks in the firewall. So something like the following command should to the job:

iptables -I FORWARD -s -d -j ACCEPT
iptables -I FORWARD -s -d -j ACCEPT

B has two interfaces ( and and it already knows where to find both subnets. So in this case you don't need to add additional routes on it.

On C, same as on A, you need to tell how to reach 192.168.1.X, that is via

ip route add via

And finally, you have to make all these changes permanent, because if you now reboot these nodes, the configuration which you have applied will be gone. How to achieve this depends on the Linux distribution you are using and is not in the scope of your current question :)

  • Thank you very much
    – hamidi
    Feb 27, 2021 at 14:45
  • What is the best source of manipulating network in such a basic class? url, document, etc?
    – hamidi
    Feb 27, 2021 at 14:51
  • I'll examine the solution and inform you about it.
    – hamidi
    Feb 27, 2021 at 14:52
  • You can check lartc.org or netfilter.org, policyrouting.org/PolicyRoutingBook/ONLINE/TOC.html
    – basekat
    Feb 27, 2021 at 14:55
  • i will, ciao...
    – hamidi
    Feb 27, 2021 at 15:00

After some trials and effort and some investigations, I could find a simpler method which omits the requirement of using iptables in B. Although most parts are the same. Let's see what has been the problems of ping packets response which were not received by A. By executing the following command in A:

route add -net gw

or as you mentioned:

ip route add via

which are the same, A which has no idea about vmnet 192.168.2.x figures out that has access to this network and it may route packets with destination 192.168.2.x. Now ping packets may be received by which is also Since packet forwarding is enabled in B, it knows that it should send them again and it knows that to what interface this should happen. Because of the destination of the packet this should take place via 192.168.2.x interface. Until now A may get response to ping, but not, but this doesn't mean that the ping packets are not received by If I use Wireshark, I may see them in C. But the problem is that C has no idea about 192.168.1.x network and doesn't know how to route packets with this destination. So the pong packets which are generated by C, can't be routed back. It's enough to add a similar routing rule in C which we may call it a route-back rule, this way:

route add -net gw

That's it. There's no need to define any rule in B, in its ip tables or routing table. Although your solution is also correct, I think this may be a simpler method and concentrates on the problem more accurately, although I'm not persisting on my solution and compliment any suggestion or correction if I'm mistaking.

  • ie. The same as your solution without adding any rules to B.
    – hamidi
    Mar 2, 2021 at 18:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.