I have a Debian Squeeze server (as router and host for virtual servers) with two network cards - eth0 for internet, eth1 for local network. I installed KVM, so I created br0 (eth0, vnet0) and br1 (eth1, vnet1). Now I need to setup local network access on this server but it is not working :( What I should do to have internet access from local network (traffic comming on br1)? Everything works ok except the internet access on lan.

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

If I don't use bridges, such configuration is working (with eth0 isntead of br0).


The MASQUERADE target is a bit "magic" as it uses the IP set up on the output interface to source-nat the traffic.

You could use the SNAT target with the public IP address in parameter :

iptables -t nat -A POSTROUTING -o br0 --to-source W.X.Y.Z -j SNAT

I you want to use the MASQUERADE target (if your public IP changes for example), you should put the rule on the interface where the public address is setup, eth0 :

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
  • Thanks but I had an error somewhere else because now it is working :) eth0 doesn't have an IP, so there must be br0 as output interface.
    – Bruce
    Feb 21 '11 at 19:54

Hmm, I set up logging in iptables and there was traffic from br1 to br0. Then I checked tcpdump on br0 and all packets from local network were with local IP address. I checked again iptables, added the same iptables command:

iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE

and now it was working... Perhaps I did some other mistake before...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.