Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Given: I have a machine (HostA) with only one NIC which has Internet connectivity. I have another machine (HostB) with one NIC on the same switch. HostB is not configured for Internet access yet. HostA has its default gateway and DNS servers appropriately configured. IPv4 is being used. OSes on the hosts are Ubuntu 13 and Fedora17.

What I want: Now, I would like HostB to have Internet connectivity, too. Is this possible using 'some' combination of iptables, virtual tun/tap devices, or a VPN setup between HostA and HostB, etc?

What I already know and can do: Currently, I can use an ssh-based SOCKS proxy on HostB (ssh -D 9050 UserA@HostA) and route traffic of select 'socksifiable' applications on HostB via this proxy to HostA and beyond. However, sadly, not all applications are socksifiable. Now, I know very well that if HostA had 2 NICs, I could have used some iptables rules to convert HostA into a gateway that would then route traffic between its NIC-1 and NIC-2 (where NIC-1 would be connected to HostB and NIC-2 to Internet). But installing another NIC in HostA is not feasible for me.

PS: I had posted this earlier on superuser.com but got no useful information.

edit 1:

network information

Host A:

:> ip addr
2: p4p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether d4:be:d9:d5:46:05 brd ff:ff:ff:ff:ff:ff
inet brd scope global p4p1 

:> ip route
default via dev p4p1 proto static dev p4p1 proto kernel scope link src

Host B:

:> ip addr
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 30:f9:ed:d9:2e:20 brd ff:ff:ff:ff:ff:ff
inet brd scope global eth0 

:> ip route dev eth0 scope link metric 1000 dev eth0 proto kernel scope link src metric 1
share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Routing is about "where (and if) to send to". That's not limited to selecting a NIC. In your case routing is very simple though.

You need masquerading in its most simple form (all commands on host A):

iptables -t nat -I POSTROUTING -s -j MASQUERADE

And maybe (if not yet) you need allow forwarding:

iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD 2 -s -j ACCEPT

Assuming host A is configured as the default gateway for Host B.

Edit 1:

After a chat discussion the situation has become clearer. In theory configuring the default gateway on B should have been enough. But it seems that the gateway (which is not under the control of the questioner) blocks host B. Thus the masquerading solution was necessary.

share|improve this answer
Thanks, for enlightening this routing-newbie. I will try out your solution soon enough and let you know. Meanwhile, I ran into tun2socks that is part of the BadVPN tool. Would greatly appreciate your opinion on this program vs. your solution... as, once again, I'm a routing/networking-newbie. –  Harry May 18 '13 at 14:18
@Harry I cannot really comment on this program as I don't know it. But "VPN" sounds like configuration effort and CPU load which you both don't need. VPNs are not used to enable connectivity; they are used to enable security. You asked for connectivity. –  Hauke Laging May 18 '13 at 14:50
Your solution didn't work. I set up A to be the default gwy on B. Then, I tried the 1st iptables command. When it didn't work, I tried the 2nd and 3rd ones also... which didn't work either. What do I do now? –  Harry May 19 '13 at 5:12
@Harry Strange. I guess you have to use tcpdump on A then to have a look what happens to the packets. Do they arrive at A, do they leave with the source address rewritten to A, do responses arrive from the Internet? –  Hauke Laging May 19 '13 at 5:16
@Harry Assumed you ping from B and the A interface is eth0 then you need: tcpdump -i eth0 -n host –  Hauke Laging May 19 '13 at 6:02
show 3 more comments

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.