I have a setup, consisting of 3 linux (CentOS) machines:


All machines the that are directly connected can ping each other.

I am trying to setup iptable rules to enable VM3 to ping VM1 and vice versa, and then connect VM1 to the internet and have all 3 machines able to access the internet.

I have enabled ip forwarding

net.ipv4.ip_forward = 1

I have added two iptables rules in VM2

-A FORWARD -i eth1 -o eth2 -j ACCEPT
-A FORWARD -i eth2 -o eth1 -j ACCEPT

I have set the default in gateway /etc/sysconfig/network

VM3 - 
VM2 - 

In VM3 I have run the command

> ip route get via dev eth1 src

However, this did not make it work. Can you help me?

  • It's been a while since I last made a similar setup (except the VM3 was directly connected to the VM1), but I think you need to add a rule to the POSTROUTING table to Masquerade the IP address before you forward the packet. This link might help you configure the network. Be aware you also will need to configure the DNS resolver on /etc/resolv.conf. – IanC Dec 18 '16 at 21:11
  • Indeed, I still had to set up IP masquerading. Thanks – berendeanicolae Dec 18 '16 at 21:25

To allow VM3 to access VM1 you will need to add a MASQUERADE rule in the nat table in the POSTROUTING chain. e.g

iptable -A POSTROUTING -o eth1 -j MASQUERADE

This will basically will put VM3 behind a NAT of VM3

  • Thank you! I solved it with iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE – berendeanicolae Dec 18 '16 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.