I am trying to implement a 1 to 1 NAT on a Linux Box. The setup is pretty basic, it has two interfaces, eth0 is the outside interface, eth1 is the inside. Behind eth1 resides the isolated network while eth0 connects to the rest of the network on (this network is irrelevant). What I want to do is allow the isolated network to communicate through the linux box using an external IP address of a different network, So basically the linux box nats from the inside network to routed out of the linux box. I've set up routes to point traffic destined for to the Linux box's eth0 interface on all external devices.

At this point, traffic destined for arrives at eth0 of the Linux box, but it never seems to translate over as I never see any traffic for either or on the internal eth1 interface. Below is my basic NAT config. My question is, do I need to do something else? I didn't bother adding routes on the Linux box for the network since the box never routes packets with that address due to this NAT config.

Outbound rule

-A POSTROUTING -o eth0 -s -j SNAT --to-source

Inbound rule

-A PREROUTING -i eth0 -d -j DNAT --to-destination

Temp rules to allow all traffic


Notice all other traffic is allowed through iptables as well by default, so it shouldn't be a blocking issue.


You need to confirm you have the following conditions met:

  1. Enable the IP forwarding using: echo 1 > /proc/sys/net/ipv4/ip_forward or by setting the appropriate line in /etc/sysctl.conf.
  2. Allow the traffic to pass through the box which should be OK according to your description.
  3. Setup the needed NAT rules which should be OK according to your description.
  4. Setup the needed routes (static or dynamic) if the routed IPs belong to subnets not directly connected to the Linux router. This should be also OK according to your description.

It seems that you are left with the first point!

  • As soon as you listed #1, I knew that was the problem. I got bit by that on an OpenVPN install and completely forgot about that setting. Sure enough, flipping that on fixed the issue, thank you very much for providing that information. – Brandon Dec 7 '11 at 23:17

It may be an ARP issue. See the Shorewall One-to-one Nat notes. I tend to prefer a firewall builder tool like Shorewall for things like this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.