I am struggling to forward packets from eth0 to eth1 (and back) on my RPi. I have enabled IP forwarding by adding net.ipv4.ip_forward=1 in /etc/sysctl.conf, and putting an ip_forward file containing 1 in /proc/sys/net/ipv4/. My IP Tables are set to accept all traffic.

The network is as follows:

PC#1( /24 gateway hardwired to RPi eth0( /24) theoretically routed to RPi eth1( /24) and then hardwired to PC#2 ( /24). PC#1 has his routing table set properly to send anything destined to the 192.168.1.x LAN through his NIC.

If I ping either the eth0 or eth1 NIC from PC#1 I get good answers, but do not get answers from PC#2. If I take a cable directly from PC#1 to PC#2, PC#2 answers the ping which tells me that PC#1's routing tables are OK, and that PC#2 is capable of answering a ping request. Additionally, if I'm sitting at the RPi, I can successfully ping PC#1 and PC#2. This only leaves the routing piece of the RPi as the bad guy. I'm not an expert at Linux and am thinking I'm missing some simple, stupid thing, but I've crawled all over the internet without success. Any help is greatly appreciated.


  • I'm sure you got your iptables wrong. What you're looking for is masquerading.
    – Aloha
    Jan 5 '16 at 0:26
  • why would you use masquerading between two private use nets? Jan 5 '16 at 2:38
  • PC#1 has his routing table set properly to send anything destined to the 192.168.1.x LAN through his NIC - does PC#2 routing include 10.0.0.x LAN through Jan 5 '16 at 2:48

You're doing stuff wrong.

  1. You should only place net.ipv4.ip_forward=1 in /etc/sysctl.conf. Do NOT modify files in the /proc folder. It's okay, just be careful.

  2. You are simply accepting traffic and you only allowed forwarding. It can forward traffic but you didn't tell it to forward traffic.

Try this: First, put net.ipv4.ip_forward=1 in /etc/sysctl.conf. Then reboot.

An alternative, if you don't want to reboot, is to run (as root) echo 1> /proc/sys/net/ipv4/ip_forward

Then, flush your entire iptables.

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

Then, masquerade the traffic, assuming eth1 is the output. Change it accordingly.

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Masquerade
iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

Then, save it using iptables-save > /etc/iptables/rules.v4

To restore, simply run iptables-restore < /etc/iptables/rules.v4

As an added bonus, you can add the command on /etc/network/interfaces so you don't have to manually run the restore command every boot. Modify that file so it looks like

# ...

auto eth0
iface eth0 inet static
# your configuration and stuff
post-up iptables-restore < /etc/iptables/rules.v4     # The line you need to add

# ...
  • Do it on both Pi routers - did you read a different question? There's only one Pi in the question ... the "WAN" side ... there is no WAN in the question either Jan 5 '16 at 2:40
  • @JaromandaX corrected. I thought there were two Pis. Realized there was one pi with two interfaces.
    – Aloha
    Jan 5 '16 at 9:14
  • @JaromandaX I just realized my answer is totally different than the question.
    – Aloha
    Jan 5 '16 at 9:17
  • Thanks PandaLion98. I did everything as per your suggestions, but, alas, I still cannot get from one network to the other across the RPi. I grabbed another SD card I had lying around with a Wheezy distro on it, and am having no better luck. I must be missing something. Among the things bothering me, is the fact that the RPi will answer pings to either of his NICs regardless of the NIC that it comes in on. I would expect this behavior with IP Forwarding enabled, but I'm getting whether forwarding is enabled or not. I think I'm gonna try another RPi just to be sure I don't have a bad RPi.
    – AutoDoc
    Jan 5 '16 at 18:50
  • Your pi is most probably okay.
    – Aloha
    Jan 6 '16 at 0:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.