I'm trying to connect two LANs using a ppp link. I had a basic network topology diagram but it didn't come out well. This can be seen here.

Routing Problem
              eth1  +-----------------+ eth0                                            |======|      Ubuntu     |======|
                    |                 |
                    |      Router     |======| |=====> To:
                    +-----------------+ ppp0

All computers in the subnet can access the internet via eth0. All devices on the subnet use as their gateway. When I ping any device on the subnet from a device on the subnet, I see that nothing is getting across from eth1 to ppp0. The way I tested this was by pinging from a device on the subnet( ping -s 10240 ) and checking all three interfaces on the router using tcpdump( tcpdump -vv -x -X -s 1500 -i eth1 ). I'm not seeing any ICMP packets on any of these interfaces. I suspect the problem is with iptables.

Configurations on the Ubuntu Router looks like this:

ip route show
default via dev eth0 dev eth1  proto kernel  scope link  src dev ppp0  scope link via dev ppp0 dev eth0  proto kernel  scope link  src dev ppp0  proto kernel  scope link  src

cat /proc/sys/net/ipv4/ip_forward 
cat /proc/sys/net/ipv4/conf/ppp0/forwarding 
cat /proc/sys/net/ipv4/conf/eth0/forwarding
cat /proc/sys/net/ipv4/conf/eth1/forwarding

iptables --list-rules
-A FORWARD -i eth1 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o eth1 -j ACCEPT
-A FORWARD -i eth1 -o ppp0 -j ACCEPT
-A FORWARD -i ppp0 -o eth1 -j ACCEPT

iptables -t nat --list-rules
-A PREROUTING -d -j DNAT --to-destination
-A POSTROUTING -o eth1 -j SNAT --to-source

I should add I've tried many different combinations of iptables rules, as well as trying different routing options.

1 Answer 1


First, the filter rules are somehow redundant. When you never drop and your policy is ACCEPT, adding some more ACCEPT rules has no point. No package will be filtered.

The way I tested this was by pinging from a device on the subnet( ping -s 10240 )

I never actually tried to send huge ping blocks of 10kByte through a network and I don't know why you do that, but a standard ping package of 56 bytes should perfectly do, to check connection and might not suffer from MTU fragmentation issues.

and checking all three interfaces on the router using tcpdump( tcpdump -vv -x -X -s 1500 -i eth1 ).

Of course when you check with tcpdump -i eth1 ... you check only eth1 but that's trivial.

As there is no filter rule, there should be no problem with iptables. At least there should be some input on some interface.

Have you checked your routing where you send your ping from?

I don't get the idea behind the rule

-A PREROUTING -d -j DNAT --to-destination

In words, packages that are addressed to, so all packages that are somehow want to go out through ppp0, will be rewritten to go to, which should be ppp0 too (not clear!). Later in the routing stage any package that goes to the ppp0 subnet will be routed to This rule looks useless to me if not destructive.

When you send packages to or any you might want to -j MASQUERADE when they leave, that the destination knows where to answer, though it doesn't know how to route.

`iptables -t nat -A POSTROUTING -s -i ppp0 -j MASQUERADE`

But that will not solve the problem that you don't see any ping package on any interface of your router.

My first attempt would be, to see the ping packages leave the system I send them from, with tcpdump on that system.

`tcpdump -i eth0 'icmp'

or only packages that should to over ppp0

`tcpudmp -i eth0 'net'

assuming that the hosts, that are not your router, only have one interface named eth0.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .