I set net.ipv4.ip_forward = 1 in /etc/sysctl.conf and ran sysctl -p which caused it to set to 1 as expected in the output of sysctl -a, but sometime between last night and now something set it back to 0. Any thoughts on what could be doing this? I grepped /var/log/cron for forward and for sysctl and didn't see anything.

  • if you are using systemd you may need to configure a different file, eg /etc/sysctl.d/99-sysctl.conf, as in archlinux – meuh Jan 21 '16 at 15:53
  • @meuh Not using systemd =( – sa289 Jan 22 '16 at 21:34
  • Can't you just do nice -19 grep -airlE 'net.ipv4.ip_forward|/proc/sys/net/ipv4/ip_forward' / ? This will give you all the files containing mentioned file of interest. – KWubbufetowicz Jan 26 '16 at 22:32
  • @KWubbufetowicz Running now - we'll see what it finds. As a side note, I'd suggest ionice -c3 instead of nice -19 because a search through non-compressed files tends to be more I/O intensive than CPU intensive. – sa289 Jan 28 '16 at 22:28

Some CentOS versions set net.ipv4.ip_forward to 0 again whenever the network service is restarted (with service restart networking for example).

To be more precise, it is set to zero in the stop section of the /etc/init.d/network script:

      [ "$EUID" != "0" ] && exit 4
      # Don't shut the network down if root is on NFS or a network
      # block device.

      # [...]

      action $"Shutting down loopback interface: " ./ifdown ifcfg-lo

      sysctl -w net.ipv4.ip_forward=0 > /dev/null 2>&1

You can edit that script and remove or change that line.

See Red Hat Bugzilla Bug 552653 for more information.

  • Ah thanks for the tip. I've edited that file to add a line which will email me should that section get called. – sa289 Jan 27 '16 at 0:19
  • Unfortunately that wasn't it – sa289 Jan 28 '16 at 22:26
  • 1
    If you're trying to debug script, you should not email anything but simply have it echo something &>/root/itdidrun.txt and examine /root/itdidrun.txt existence and it's contents. – user140866 Jan 29 '16 at 5:11
  • @siblynx What's wrong with having it email? – sa289 Feb 1 '16 at 16:48
  • Because network always unreliable. – user140866 Feb 2 '16 at 14:55

There is a bug which causes sysctl values to be loaded before the network is properly initialized. This causes network settings in /etc/sysctl.conf to be ignored. A solution to this may be to procps restart to /etc/local.rc, so the initialization is repeated.

The bug in question: https://bugs.launchpad.net/ubuntu/+source/procps/+bug/50093


I put logging in place to record the value of this setting every minute so then I could check /var/log/cron and see what might be responsible. It looks like the reverting corresponds to a cron job for APF (Advanced Policy Firewall) running.

Here's my mini logging script in case it's helpful to anyone:

echo `date`" - "`sysctl -a | grep net.ipv4.ip_forward` >> /var/log/ip_forward_setting.log

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.