I am using a box running Arch as my router and firewall (with shorewall). Recently, I tried to add another network onto the system, which failed horribly. After putting everything back where it was before this, and confirming that everything is exactly the same, I am having some issues with routing from my internal network ( to the outside. Here is the current situation:

  • I CAN ping the external network from my firewall
  • I CAN ping the firewall from my internal network
  • I CANNOT ping the external network from the internal network

I have two network interfaces, enp5s0 (internal) and enp6s0 (external). Here are my routes from ip route ls (note my external ip ends in .78, I redacted the rest for obvious reasons):

default via [redacted].1 dev enp6s0  src [redacted].78  metric 203  mtu 576
[redacted].0/24 dev enp6s0  proto kernel  scope link  src [redacted].78
[redacted].0/24 dev enp6s0  proto kernel  scope link  src [redacted].78  metric 203  mtu 576 dev enp5s0  proto kernel  scope link  src  metric 202  

A traceroute from the machine on the internal network reveals that it gets to, then times out. I suspect I need to add another route allowing traffic coming from to be routed through enp6s0 out to the net. I've tried different routes, and none have worked. Also, my dhcpcd.conf did change. If the commented line is uncommented, it creates a second default route which stops any connection at all. Previously, this was not an issue.

interface enp5s0
static ip_address=
#static routers=
static domain_name_servers= # I have TOR DNS bound to this ip  

Any help would be much appreciated.

  • Yes, IP forwarding is enabled. – Rogue May 29 '16 at 15:34
  • Assuming you're using a public IP address on enp6s0 then you'll need to configure NAT, not IP forwarding. – garethTheRed May 29 '16 at 16:23
  • @garethTheRed Shorewall should be handling NAT, no? – Rogue May 29 '16 at 16:35
  • It should, if configured correctly... – garethTheRed May 29 '16 at 17:30
  • @garethTheRed It appears that it's never making it to shorewall. I see nothing in the logs when I try to ping or make an HTTP connection – Rogue May 29 '16 at 17:56

I've done something like that on an Arch server. The server had enp4s8 as the "external" network, and wlp1s0 as the "internal" network. enp4s8 had a statically-defined IP address of, and a default route to, the DSL modem.

/usr/bin/ip link set dev wlp1s0 up
/usr/bin/ip addr add dev wlp1s0
sleep 10

modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s -j MASQUERADE
iptables -A FORWARD -o enp4s8 -i wlp1s0 -s -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

dhcpd -cf /etc/dhcpd.wlp1s0.conf wlp1s0

You may not have IPv4 forwarding turned on, and getting the iptables right is sometimes difficult.

The other part of the trick is in /etc/dhcpd.wlp1s0.conf. I think you have to tell machines on the "internal" network about their default route and router with DHCP:

option domain-name "fleegle";
option domain-name-servers;
option routers;
option ntp-servers;
default-lease-time 14440;
ddns-update-style none;
deny bootp;
shared-network intranet {
        subnet netmask {
                option subnet-mask;
                pool { range; }
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.