The environment is FreeBSD for the most part and looks like this:


Minimally, I would like to be able to ping ROUTER from HOST_B.

  • ROUTER is assigned the IP
  • LOKI is a multi-homed machine that is assigned IPs and
  • HOST_B is assigned the IP
  • HOST_A is assigned the IP

I have set the network up as above and added gateway_enable="YES" to loki's rc.conf

netstat -r on LOKI produces:

Routing tables
Destination        Gateway            Flags      Netif Expire
default             UGS         em0           link#1             U           em0           link#1             UHS         lo0
loki               link#2             UH          lo0      link#3             U           ue0      link#3             UHS         lo0

which looks like a fine routing table and appears to work in all directions.

netstat -r on HOST_B produces:

Routing tables
Destination        Gateway            Flags      Netif Expire
default        UGS         em0
hostb              link#2             UH          lo0      link#1             U           em0      link#1             UHS         lo0

which looks like another fine routing table, but is only able to see LOKI.

In summary:

  • LOKI is able to ping HOST_A, HOST_B and ROUTER
  • HOST_B is able to ping LOKI, but not ROUTER or HOST_A

Some additional notes: from HOST_B

ping 100% packet loss

In wireshark on LOKI, while pinging from HOST_B:

120 40.549564000    ICMP    98  Echo (ping) request  id=0x5a0e, seq=92/23552, ttl=63 (no response found!)

It appears to me that nothing is being routed from LOKI to ROUTER. What am I missing?

I confirmed that IP forwarding was taking place by commenting out gateway_enable="YES" in /etc/rc.conf and rebooting.

Then, I ran the following commands on loki:

sudo tcpdump -i em0 -nS
sudo tcpdump -i ue0 -nS

to monitor activity on the two nics.

from hostb, I ran:


the ue0 interface on reported:

14:44:21.870865 IP > ICMP echo request, id 21509, seq 0, length 64

nothing was reported on the em0 interface on

I then ran:

sudo sysctl -w net.inet.ip.forwarding=1

and sure enough, em0 reported:

14:58:14.745369 IP > ICMP echo request, id 25861, seq 0, length 64

But no, reply such as what I get with a ping loki from hostb:

14:44:15.724200 IP > ICMP echo request, id 21253, seq 4, length 64
14:44:15.724207 IP > ICMP echo reply, id 21253, seq 4, length 64

If I ping router from loki, all is fine:

15:04:55.637839 IP > ICMP echo request, id 46852, seq 3, length 64
15:04:55.638324 IP > ICMP echo reply, id 46852, seq 3, length 64

Any ideas how to find the reply?


Why are LOKI and HOST_A connected by a router when they are on the same subnet? Is it really a router, or is it just a switch? (From your later comments, although the device is a router, it is just acting as a switch between LOKI and HOST_A).

What is the routing table on HOST_A and ROUTER? If it were to try to reach, why should it use LOKI as a destination?

Unless the routing table on these devices know to use LOKI for the 192 subnet, they will just forward to the default gateway.

As an alternative, you might want to investigate installing NAT on LOKI. For many services, it can encapsulate traffic from HOST_B as traffic from LOKI. Since other machines can get to there, it can receive the traffic and forward back to HOST_B.

  • It's a router with a wan port and 4 lan ports. HOST_A and LOKI are plugged into 2 of the lan ports on the switch. At this point, I am looking at HOST_B being able to see either HOST_A or ROUTER, not the other direction. If I only want HOST_B to be able to see ROUTER, is it necessary for ROUTER to have a route to HOST_B as well (through LOKI)? – decuser Nov 6 '15 at 22:48
  • "see" implies bidirection. Packets from HOST_A may be making to ROUTER, but it doesn't know how to send the reply back. Yes, it's necessary for it to have a valid route back. – BowlOfRed Nov 6 '15 at 22:50
  • If you can't get a real routing table set on your ROUTER, you could consider setting up NAT on LOKI and having it forward packets to HOST_B that way. It's more limiting than full routing, but is usable in cases where you can't get the routing tables updated in the rest of the network. – BowlOfRed Nov 6 '15 at 22:52
  • I am beginning to understand the problem. Is this what NAT is for? If I am not using NAT, then ROUTER needs a static route set up with LOKI as the gateway for 192.168.200.X/? – decuser Nov 6 '15 at 22:53
  • Yes, NAT rewrites the packets as coming from LOKI (which the router does know how to reach), then forwards them on to HOST_B. Otherwise ROUTER needs a route (static or otherwise) to correctly reach the 192 network via LOKI. – BowlOfRed Nov 6 '15 at 22:59

It seems to me that LOKI is doing exactly what you expect. It received a ping request packet on ue0 and relays it to em0. If it received a ping reply on em0, it would relay it to ue0.

The problem is ROUTER. It receives a ping request from on its LAN side (but that doesn't matter). When it sends a ping reply to, it looks at it's routing table. LAN side is (or similar) so the reply packet is sent to the ROUTER's default gateway, which is WAN side on the public Internet.

The ROUTER uses network address translation (NAT) to fake a network behind your one true public IP address (assigned to the WAN side of the ROUTER, by your ISP). The RFC1918 addresses are private and cannot be exposed to the public Internet, and will always live behind NAT.

You could place a static route into ROUTER to make your ping experiment work, but that will still be isolated from the public Internet. You could enable NAT on LOKI, in which case you have double-NAT to the Internet (which works fine, but fairly pointless). If you just need a second level firewall you might consider making LOKI a bridging firewall and running on both NICs. If you want to host internet-facing services, and you only have one public IP address, you are forced to use port-forwarding rules on ROUTER.


Something has to be set to forward packets from Network A to Network B. Loki, being dual homed, could do this, but it is not automatic. In doing so, you'll be setting Loki up as a router, and should use Loki as the default gateway for Host B. Another option is to set a permanent route in Host B's routing table specifying Loki as the destination for 10.x.x.x traffic.

  • I set gateway_enable="YES" in rc.conf on loki, is another step required to forward the packets? – decuser Nov 6 '15 at 19:13
  • That is a good question that I do not know the answer to. – Xalorous Nov 6 '15 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.