Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an experimental setup, of 4 Linux (CentOS) machines:


All 4 machines are internally connected using different networks and can ping eachother directly connected interfaces. However only PC4 has access to internet.

I am trying to setup iptables rules that can allow PC1 to be able to access internet via PC4, but I have no idea how to do this.

I tried to add NAT at outgoing interface on PC2, PC3 and PC4:

iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

However, this does not work, can you give me some idea how in such a setup i can make PC1 access network??

share|improve this question
can not add image because of less points, so added the URL – johny Feb 14 '13 at 16:46
This is most likely not a problem with iptables (masquerading looks correct) but with routing. Do all the clients have PC4 as default route/gateway? Also, do you have forwarding enabled in all the intermediate PCs? (via sysctl or whatever your distro has) – Karma Fusebox Feb 14 '13 at 17:24
Oh, and of course the masquerading should only be applied on PC4, not on every machine. – Karma Fusebox Feb 14 '13 at 17:36

First, each PC need to use the next one as gateway to the intertubes:

PC1# ip route add default via # PC2's address where it can join PC1
PC2# ip route add default via # PC3's address where it can join PC2
PC3# ip route add default via # PC4's address where it can join PC3

And because it is a default route, it means that now each PC can access the next. So, now, all PC can (theoretically, if rp_filter¹ is not enabled) send packets to the next one and the internet. However, there is no return path.

For this, each PC need to be able to access all the not-directly-connected previous ones.

PC1 has no previous one, so no problem. PC2 is directly connected to PC1, so still no problem. For PC3, it need to route to PC1 via PC2:

PC3# ip route add via # PC1's network via PC2
# Fill the '?' according to PC1's network mask. it should include

Now, PC3 and PC1 should be able to ping each other. If they don't, check that PC2 has forwarding enabled (sysctl -w net.ipv4.eth?.forwarding=1 for both interfaces). Make sure that all your PC have this option set, except for PC1 where it is useless.

Now, PC4 need a route for PC2 and PC1 via PC3.

PC4# ip route add via # PC1's network via PC3
PC4# ip route add via # PC2's network via PC3

Now all your PC should be able to ping each other. If they don't, check your setup again and make sure forwarding is enabled.

Now, connecting to the internet should just work. if PC4 need to NAT to access the internet, then configure a NAT on PC4, without touching your routing tables.

¹ rp_filter is an option which is generally useful, but makes testing more complicated: it checks that the reverse path is correct before accepting a packet. If a packet is received from eth0 from ip, then it checks that is routed via eth0. If it isn't the case, it rejects the packet. So rp_filter does not tolerate partially configured setups, but once your setup is complete, rp_filter can be activated and will work just fine. rp_filter is enabled by default in some linux distributions as a security measure.

share|improve this answer
Should'nt it be sufficient to set PC4 as default gateway on all PCs instead of "chaining" them? – Karma Fusebox Feb 14 '13 at 22:03
@KarmaFusebox: PC1 cannot even route to PC4, how are you going to add a default route via PC4 ? And how are you going to handle the return path ? – BatchyX Feb 14 '13 at 22:58
Yup, realized it myself. – Karma Fusebox Feb 14 '13 at 23:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.