Having an issue with my Linux as a gateway setup. Not sure what I'm doing wrong here.

What is expected:

  1. Computers have services forwarded based on DHCP reserved ip addresses.
  2. I can reach the servers from the internet (I have a DDNS)

Network Architecture:

  1. Internet
  2. Router (DDNS attached)
  3. Linux Box - (Wired Computer Named Gateway) - IP (External on enp9s0) (Internal on enp7s5)
  4. Switch - IP
  5. Multiple Computers - (Wired) - IPs,,,

What works:

  1. DHCP provides Reserved IP addresses
  2. Computers internally have internet
  3. I can ssh into the Gateway from a computer on the same network as enp9s0 (NOT FROM INTERNET)
  4. DDNS forwards information correctly to the router


  1. Ports do not forward to internal computers
  2. I can not reach anything from the internet

Extra information: This is a shared network. There will be windows and linux machines in the same network.



# enp9s0 is WAN interface, enp7s5 is LAN interface

# NAT pinhole: HTTP from WAN to LAN
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 80 -j DNAT --to-destination
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 8086 -j DNAT --to-destination$
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 7990 -j DNAT --to-destination$
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 8080 -j DNAT --to-destination$
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 8090 -j DNAT --to-destination$
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 8085 -j DNAT --to-destination$
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 9002 -j DNAT --to-destination
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 9003 -j DNAT --to-destination
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 9014 -j DNAT --to-destination$
-A PREROUTING -p tcp -m tcp -i enp9s0 --dport 9005 -j DNAT --to-destination



# Service rules

# basic global accept rules - ICMP, loopback, traceroute, established all accepted
-A INPUT -s -d -i lo -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT

# enable traceroute rejections to get sent out
#-A INPUT -p udp -m udp --dport 33434:33523 -j REJECT --reject-with icmp-port-unreachable

# DNS - accept from LAN
-A INPUT -i enp7s5 -p tcp --dport 53 -j ACCEPT
-A INPUT -i enp7s5 -p udp --dport 53 -j ACCEPT

# SSH - accept from LAN
-A INPUT -i enp7s5 -p tcp --dport 9001 -j ACCEPT
#SSH - accept from wan
-A INPUT -i enp9s0 -p tcp --dport 9001 -j ACCEPT

# DHCP client requests - accept from LAN
-A INPUT -i enp7s5 -p udp --dport 67:68 -j ACCEPT

# drop all other inbound traffic

# Forwarding rules

# forward packets along established/related connections

# forward from LAN (p1p1) to WAN (p4p1)
-A FORWARD -i enp7s5 -o enp9s0 -j ACCEPT

# allow traffic from our NAT pinhole
-A FORWARD -p tcp -d --dport 80 -j ACCEPT
-A FORWARD -p tcp -d --dport 7990 -j ACCEPT
-A FORWARD -p tcp -d --dport 8085 -j ACCEPT
-A FORWARD -p tcp -d --dport 8080 -j ACCEPT
-A FORWARD -p tcp -d --dport 8090 -j ACCEPT
-A FORWARD -p tcp -d --dport 8090 -j ACCEPT
-A FORWARD -p tcp -d --dport 22 -j ACCEPT
-A FORWARD -p tcp -d --dport 22 -j ACCEPT
-A FORWARD -p tcp -d --dport 9014 -j ACCEPT
-A FORWARD -p tcp -d --dport 22 -j ACCEPT

# drop all other forwarded traffic


DHCP server:

# Sample configuration file for ISC dhcpd for Debian
# Attention: If /etc/ltsp/dhcpd.conf exists, that will be used as
# configuration file instead of this file.

# The ddns-updates-style parameter controls whether or not the server will
# attempt to do a DNS update when a lease is confirmed. We default to the
# behavior of the version 2 packages ('none', since DHCP v2 didn't
# have support for DDNS.)
ddns-update-style none;

# option definitions common to all supported networks...
option domain-name "example.org";
option domain-name-servers ns1.example.org, ns2.example.org;

default-lease-time 600;
max-lease-time 7200;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

subnet netmask {
        option routers;
        option domain-name-servers;
        option broadcast-address;
host Bitbucket {
hardware ethernet 00:0f:fe:f6:34:ea;

host LaptopMSI {
hardware ethernet 44:8a:5b:ef:e9:0f;

host SkullCanyon  {
hardware ethernet 00:1f:c6:9b:e2:20;

host ConfluenceJira {
hardware ethernet fc:aa:14:65:31:e2;

Interface: # This file describes the network interfaces available on your system # and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto enp9s0
iface enp9s0 inet static
# This is an autoconfigured IPv6 interface
iface enp9s0 inet6 auto

auto enp7s5
iface enp7s5 inet static

Thank you everyone for your help!

  • You posted information about your gateway, but you did not tell us how default gateway is configured on your internal machines and IP address you used for your router and how they are connected. Do you have two gateways (Linux box and Router)? – Khaled Dec 26 '16 at 7:52
  • The section network architecture is in correct order. Outward in. 1 being the start and the 5 being the end. – timcoolmode Dec 26 '16 at 7:57
  • The router is connected directly to the Internet. It is a router/modem router ip is – timcoolmode Dec 26 '16 at 7:59
  • And one more I seem to have forgotten. I'm using reserved ips on the dhcp in the gateway so all systems internal recieve their ips from that. They are not set as static on their end but have the correct ips when I log in to them. – timcoolmode Dec 26 '16 at 8:02

I believe the issue is the fact that you're trying to access services from a computer thats behind a second NAT.

To begin with your server is within the existing NAT pool behind your router which in itself is not a routable address (192.168.99.x).

Your router/modem should be configured as bridge and your server external IP should be the ip the ISP gave you, then you can have the server NAT the internal computers. In other words, your linux server would become a router which there is nothing wrong with that. Many third party router firmware ARE linux, in fact i had a similar setup back when i was i college learning about linux. My router was a linux server :D

Since youre on the path to using linux as a "router", i would recommend using Webmin for a CP for much easier configuration. http://www.webmin.com/download.html

  • Why can all my computers internally reach the Internet? – timcoolmode Dec 26 '16 at 14:49
  • So the recommendation is to dmz the gateway computer? – timcoolmode Dec 26 '16 at 14:50
  • The computers can access the internet because the traffic can be routed to the inside to reach out. BUT what youre trying to do is from the outside reach in, which you cant do with a private IP address. So yes, the gateway PC will have to be the firewall. – xR34P3Rx Dec 26 '16 at 17:03
  • short, if you want to forward services from your internal network out to the internet, the PC with the service can only be behind one NAT that is directly connected to your gateway. – xR34P3Rx Dec 26 '16 at 17:05
  • So I'm converting that gateway computer into a sniffer bridge so I get a firewall of its own. Let's see what happens. – timcoolmode Dec 26 '16 at 17:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.