0

I'm new with Linux and iptables. I have a Ubuntu Server distro (12.04) on a PC which has 2 network interfaces (eth0 and eth1). I also have 2 laptops, one is plugged to eth0 and the other to eth1.

laptop1 ipconfig: 172.16.221.120 - 255.255.252.0 laptop2 ipconfig: 192.168.222.250 - 255.255.255.0

I want to ping the laptop2 from laptop1 successfully.

Do I have to create INPUT and OUTPUT rules? Or a FORWARD rule, too?

I've tried this with no success:

iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT
0

You can use tcpdump in order to find out how far your pings come:

tcpdump -i eth0 -n icmp
tcpdump -i eth1 -n icmp

Furthermore it's not enough to allow pings on the server; the laptops must be configured so that they know they can reach the other one via the server (routing).

Probably your firewall has a rule which allows packets which are a reply. If not then you also need

iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

which makes sense anyway as you probably want to allow both laptops to ping the other one. You may limit this to pings and pongs, though:

iptables -A FORWARD -i eth1 -o eth0 -p icmp --icmp-type echo-request -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -p icmp --icmp-type echo-reply -j ACCEPT

The last problem is the laptops themselves: If at least one of them has its own firewall then it may block pings (in general or due to the source address outside the interfaces network).

0

By default, you do not need any rules as the netfilter chains are empty with an ACCEPT default policy. If you have added rules already, then to allow the ping through will need rules added to the FORWARD chain.

You will also need to set up the server as a router and make sure each laptop has the server as it's default route (or at least have a route for the other laptop's subnet).

To enable routing (IP forwarding), you need to set /proc/sys/net/ipv4/ip_forward to 1. Ubuntu should have /etc/sysctl.conf where you can set up items in /proc/sys automatically:

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

If you do change this, you will need to load the changes into the kernel:

sudo sysctl -p /etc/sysctl.conf

The change will automatically be loaded on next boot so you only need to run this command manually once after changing /etc/sysctl.conf.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.