1

I remember I had to enable ip_forward kernel parameter in the past in order to run SNAT/DNAT rules in iptables successfully.

Today I was reading this post: http://blogs.aws.amazon.com/security/post/TxFRX7UFUIT2GD/How-to-Add-DNS-Filtering-to-Your-NAT-Instance-with-Squid

Per the author of above post, You do not have to enable IP Forwarding or add any FORWARD rule. You may search for the bold text in above article.

and then the author goes on to configure 2 iptables prerouting (DNAT) rules.

Questions: So, Does this mean that postrouting/prerouting (DNAT/SNAT) can work without ip_forward ? OR am I missing something obvious here?

1

Quoting

By default, the IPv4 policy in Linux kernels disables support for IP forwarding. This prevents machines that run Linux from functioning as dedicated edge routers.

I made a test of redirection of the port 80 to a VM with PREROUTING without ip_forward enabled and it didn't work. When enabling ip_forward it success. So as I saw, the ip_forwarding option enables is necessary for the DNAT/SNAT service.

See more in here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.