I need to set up routing, preferably with iptables, that does no NAT. Basically I will have a number of clients on subnet and they need their traffic to go through a gateway, say and that gateway then passes on the request, without translating the original address, to another gateway, say What I really want to do is use iptables so I can configure a fine grain firewall to do the routing but all I can find info on is how to do this with NAT. Which I have done before. Any insight on how to do the routing without NAT?

  • 1
    "assigning us a Class C subnet" -- I'll bet they aren't. – womble Aug 5 '12 at 0:08
  • Our institution owns a Class B block of public addresses. They are assigning us a Class C block. Why do you say they are not? – Erik Weiss Aug 5 '12 at 0:12
  • 4
    If your institution "owns" a class B subnet, they cannot, by the very definition of a classful addressing, assign you a class C subnet out of that block. Cannot be done. That's before we start into the issue of classful addressing being declared obsolete over 20 years ago... – womble Aug 5 '12 at 0:20
  • Fair enough, call it what you like, but they are "allocating" us a class C subnet of addresses and I am stumped on how to do the routing with iptables. I will edit my original question to generalize it. – Erik Weiss Aug 5 '12 at 0:27
  • 2
    They're not allocating you a class C subnet either. Classful addressing is dead. – womble Aug 5 '12 at 0:38

Routing without NAT is just like routing with NAT... only without the NAT. You add routing table entries to indicate next-hop destinations.

Firewalling without NAT is just like firewalling with NAT... only without the NAT. You add firewall rules to permit traffic with certain attributes (source/dest addresses and ports, protocols, state parameters, etc) in like with organisational policy.


No need nat here, add your deny/accept rules to FORWARD chain of filter table,

also don't forget to enable forwading on both devices:

echo 1 > /proc/sys/net/ipv4/conf/all/forwarding

or setup it via sysctl (net.ipv4.conf.all.forwading=1 in /etc/sysctl.conf)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.