I have several industrial machines. Each machine is an isolated network,, with three elements: A Raspberry Pi, a PLC, and an HMI. The IP addresses of the three components are static and they are the same for all machines. For example, the PLC is always at

I am currently testing with a wifi network, The wlan0 interface of the Raspberry Pi and my laptop are in this network.

This is a schema of our set-up:

Routing diagram

What I want is to gain access to the PLC of each machine from the wifi network. For example, I would like to reach the PLC in machine 1 using the address

For this, the Raspberry Pi should be configured to forward packages and to do a NAT translation. The external address arriving to wlan0 should be translated to over eth0.

At this point, I can ping the PLC from the Raspberry Pi using but it is not responding when I try with

I have tried the following:

pi@raspberrypi:~ $ sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
pi@raspberrypi:~ $ sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT
pi@raspberrypi:~ $ sudo iptables -t nat -A PREROUTING -d -j DNAT --to-destination

So, my tables look like this:

pi@raspberrypi:~ $ sudo iptables -t nat -S
-A PREROUTING -d -j DNAT --to-destination

pi@raspberrypi:~ $ sudo iptables -S
-A FORWARD -i eth0 -o wlan0 -j ACCEPT
-A FORWARD -i wlan0 -o eth0 -j ACCEPT

and I put net.ipv4.ip_forward = 1 in /etc/sysctl.conf and I set /proc/sys/net/ipv4/ip_forward to 1 as well.

EDIT OF APRIL 23, 2020:

As before, I can ping the PLC from the Raspberry Pi using the address, which uses the interface eth0. I still cannot ping The destination host remains unreachable.

Running tcpdump over eth0 shows me the pings directed to, which succeed, but it does not show me those directed to Therefore, my guess is that NAT is not working.

Running tcpdump over wlan0 and then pinging shows a who-has ARP requests for each package sent. So, requests are not being forwarded to

I did check that /proc/sys/net/ipv4/ip_forward is set to 1.

Help is greatly appreciated!

  • What is PLC and HMI? Each machine has a RasPi and there is an additional RasPi on network, right? It is difficult to have your setup in mind only from the textual description. Can you please provide a simple drawing?
    – Ingo
    Apr 15, 2020 at 15:15
  • A PLC and an HMI are devices which communicate with the Raspberry Pi over the Ethernet network Each machine has a Raspberry Pi. There is no additional Raspberry Pi on; there, I have just my laptop. After reading your comment I improved my question and added a diagram; I hope my edit will be approved soon. Apr 21, 2020 at 15:45

2 Answers 2


The setting on the RasPi is OK so far. You do not need iptables rules

pi@raspberrypi:~ $ sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT
pi@raspberrypi:~ $ sudo iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT

but they don't hurt. It's all ACCEPTed in the FORWARD chain. But I would not set more than needed.

The quirks is on the PLC. It receives packages with source address from network If you ping from, then the source address is just that but the PLC, residing on network, does not know where to send its replies to network Just tell it that it has to send replies back to the RasPi with a route

plc:~ $ sudo ip route add via

and it should do.

By the way: with this setting you are not able to connect to the RasPi direct from the network. You may consider to give the wlan0 interface a second ip address.

  • In the PLC, the gateway is defined as, the Raspberry Pi. Ping packets are not reaching the eth0 interface of the Raspberry Pi when I ping Apr 23, 2020 at 10:22
  • @JulioFraire Do you try to ping from the PLC? This does not work with Destination NAT on the RasPi because NAT only works in one direction. Do you also need a connection from the PLC to network That wasn't said in the question. Then an additional Source NAT on the RasPi may help, but haven't tested it yet. But ping from to the PLC should work. Can confirm this?
    – Ingo
    Apr 23, 2020 at 12:54
  • Thank you, @Ingo. After your post I knew there was something even more basic going on. After assigning the PLC an address in a different network, I can indeed connect both to the Raspberry Pi and the PLC just fine (another take to your comment about giving wlan0 a second ip address). Apr 28, 2020 at 9:21

I have figured out my errors, so I am posting this in case it is useful.

The problem is that I was pinging the PLC at the new IP address from the Raspberry Pi. I was logged, either through the console or through SSH, into the Raspberry Pi. So, my pings did not go through the PREROUTING chain.

However, doing it through the laptop might have worked.

Moreover, it was not a good idea to assign the "external" IP address in the same network as the Raspberry Pi. I changed the new, external address of the PLC from to, so that a new network is now in place. I don't know if the old schema works or not.

So, with forwarding active, and as long as I ping the PLC from a device other than the Raspberry Pi, the following set-up does work:

pi@raspberrypi:~ $ sudo iptables -t nat -A PREROUTING -d -j DNAT --to-destination

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.