I'm trying to set up a bastion network with lan access to internet. This is my diagram.

enter image description here

I have internet acces in the linux firewall (I'm using a lubuntu 16.04). And I can ping from lubuntuclon ( to the firewall ( perfectly. So I think is working. The problem is that I cannot acces internet from the LAN. I think it's a matter of iptables but It's not working as expected. This are the iptables rules I'm using:

Flush the rules:

iptables -F
iptables -X
iptables -Z
iptables -t nat -F


iptables -P INPUT ACCEPT
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT


iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s -i enp0s8 -j ACCEPT -->so the LAN has access to the firewall
iptables -t nat -A POSTROUTING -s -o enp0s3 -j MASQUERADE  --> so the lan has internet access

but when I ping from lubunutuclon or winxpclon I got no response. I cannot acces internet from browser neither, of course.

I think my rules are wrong. But I cannot figure why. Any help?


I think you forgot to enable ip forwarding on the Linux firewall:

# sysctl -w net.ipv4.ip_forward=1
  • I try it, but it didn't work. Still can't ping the linuxfirewall or the lubuntuclon. However, if I run tcpdump -i enp0s3 I can see the response packets but they go trough enps03 instead of enp0s8, any idea? and thanks for your help! – Peyu Jul 25 '17 at 18:19
  • Do you see Something with tcpdump on enp0s8 (while testing ping) : ARP frames, ICMP packets ? – Alexandre Fenyo Jul 25 '17 at 21:22
  • I'm not sure why, but I can ping ok now. (I think the ip forwarding do works after all). The firewall see and respond to the pings of lubuntuclon. Now I need to access internet from lubuntuclon. What iptables rules do I need to set? thank you for yor help. – Peyu Jul 26 '17 at 1:04
  • You do not need any other rule, since the default policy is ACCEPT. It should already work correctly. – Alexandre Fenyo Jul 26 '17 at 1:08
  • mmm... are you sure I'm not missing some Nat rule? Beacause I cannot acces internet from lubuntuclon. I think the linux firewall needs to translate the (lubuntu address) to I'm trying that, but still no success... – Peyu Jul 26 '17 at 4:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.