I want to create a gateway on linux which has 2 interfaces eth0 and eth1.

Eth1 is created by a lte modem and once the lte modem attaches to the network and gets an ip address. Then a dhcp server is run on the gateway to provide this IP address (example: to the PC connected to the eth0 lan network. then eth0 is assigned with ip address

Now eth1 itself is not assigned any ip address.

Now i would like to forward all the packets received from pc on the lan interface eth0 to the eth1 wan interface.

Kindly suggest me the ip tables rules i need to use to create this forwarding.

Kindly note due to the limitation of the lte modem, bridge mode cannot be used and due to the limitation of the architecture to be created, NAT mode also cannot be used.


Where you are going, you don't need iptables.

What I understand you want to do is to have the gateway forward IP packets between two interfaces without the gateway performing any NAT on the forwarded packets. You can do this without any iptables rules.

My knowledge of LTE is lacking. So if there turns out to be any LTE specific caveats, I won't be able to help you with those. My answer will for the most part assume eth0 and eth1 are both running ordinary IPv4 over Ethernet.

First of all you need to ensure forwarding is enabled:

echo 1 >/proc/sys/net/ipv4/ip_forward

Packets arriving from the Internet will arrive on eth1. But the sender of those packets may need to perform ARP requests for which isn't assigned to your gateway. So your gateway will not respond to those ARP requests unless you enable ARP proxying:

echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp

Once the ARP reply has been sent, the rest of the processing of incoming packets happens using ordinary IP packet forwarding, no magic needed.

Packets from the PC to the gateway require no tricks to arrive at the gateway through eth0. The tricky part then is how to get them to leave through the eth1 interface.

You need a default route. But the gateway for that route would presumably be, which you just assigned to eth0 on the gateway you are setting up. However if you know the MAC address of the original gateway, you can get this to work without needing a real gateway IP address.

First you invent a placeholder gateway IP address (should be an RFC 1918 address, which you don't need to communicate otherwise). For the example I'll assume

ip neigh add lladdr xx:xx:xx:xx:xx:xx dev eth1
ip route add dev eth1
ip route add default via

Because is created as a permanent entry in the ARP cache on your gateway, no ARP requests will be sent for this address. That means it will not be a problem that the next gateway is unaware of your chosen placeholder IP address.

  • Thanks for your answer. But i have already enabled echo 1 >/proc/sys/net/ipv4/ip_forward. But what i found was this only works when eth1 has an ip address. And as i have mentioned above, the wan ip address received from network is passed onto the connected pc. so eth1 does not have an ip address. Kindly let me know what else i can do? – Syed Aslam Aug 3 '15 at 22:38
  • @SyedAslam You can always make up an RFC 1918 address and assign it to eth1. The IP address assigned to the interfaces have no influence on packets forwarded through the node. – kasperd Aug 4 '15 at 5:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.