I'm trying to route some public and private IP addresses using Ubuntu Server 18.04 using iptables. Please note: I've changed the first bits of my IP Address for privacy, but kept it numerical for readability. I've also enabled all the proper prerequisites like setting /proc/sys/net/ipv4/ip_forward.

Here's my NIC configuration:

eno1 (private, internal network)

enp12s0f0 (public, outgoing interface)

enp12s0f1 (public, internal interface)

Basically, enp12s0f0 is the interface connecting me to the provider.

The switch connected to enp12s0f1 will supply public IP addresses to equipment that needs them. For example, set up as a web server, or as a PBX server.

Finally, eno1 connects to the internal network ( as a gateway, forwarding traffic out enp12s0f1.

Here's the configuration I've been using in /etc/rc.local:


iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables -F
iptables -X

iptables -t nat -A POSTROUTING -o enp12s0f1 -j SNAT --to-source $myoip
iptables -t nat -A POSTROUTING -o enp12s0f0 -j SNAT --to-source $myip

#IP Routing

iptables -A FORWARD -i enp12s0f1 -j ACCEPT

iptables -t nat -A POSTROUTING -o eno1 -j SNAT --to-source $myoip

And the output of ip route is:

default via dev enp12s0f0 proto static dev eno1 proto kernel scope link src dev tun0 proto kernel scope link src #<- NOTE: Part of my OpenVPN config dev enp12s0f0 proto kernel scope link src dev enp12s0f1 proto kernel scope link src

I've tried various different modifications to the configuration, and in some instances the public network works and traffic moves to the appropriate host, but then the internal network wont work at all. On other occasions, the internal network works, but it will not let any traffic through to the public internal network. I feel like it only wants to forward traffic to one of the interfaces, but I know it can do both. It seems to be just outside of reach. Pulling my hair out here! Please help :)

  • IP: looks like a typo and won't work properly because in this case (on an address rather than only on a route) will be seen as the network address (=> ethernet broadcast to it and no arp reply from it). If the gw were to be then it would be fine. – A.B May 4 at 22:16
  • Also I don't understand why you are NATing public IP addresses. Why have them if they won't be used? Actually too many things look weird to me. iptables -A FORWARD -i enp12s0f1 -j ACCEPT is either useless (default policy ACCEPT) or won't work (default policy DROP) because return traffic won't be allowed. – A.B May 4 at 22:24
  • And please have a look at this: xyproblem.info – A.B May 4 at 22:32
  • IPTables does not do routing, it does firewall duties and NAT. You need to setup the routing part of public IPs using standard routing tools and only use IPTables for NAT / firewalling. – Tero Kilkanen May 5 at 6:19
  • @A.B you're correct, it was a typo. I don't want to use NAT, I converted this box from a single-IP configuration with NAT and want to have a single interface with NAT and a single interface without it. The network needs to be NAT, as it will have a single IP address (preferable that of the router, I'd love a working config, but even if someone could point me in the right direction for a website with information on what I need? There's lots on routing between single interfaces, but what about routing through multiple? Wouldn't I need multiple "default" routes? – Tim Powell May 5 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.