Set up: Cable modem --> HW Ethernet port on Ubuntu 16 box (eth0). OpenVPN client connection (tun0) over eth0. 2nd HW Ethernet port on Ubuntu 16 box (eth1) to hardware router.

I can set up internet sharing over eth1 and run that as a DHCP server with typical

Assume for iptables that eth0 has, tun0 has, and eth1 has

Is it possible to simply have all the data coming in and out of eth0 be sent to eth1, without this masquerade? That way, all data from the cable modem WAN is flowing through the Ubuntu box to the hardware router, but the hardware router can still do its NAT job without the Ubuntu box doing it in between. Is this possible?

Thank you!

  • You can bridge eth0 and eth1, which would mean they are effectively on the same LAN segment and need the same address range. Also, everything behind eth1 and the hardware router would be directly connected to the cable modem, and get addresses via DHCP from it, so I guess that would be Is that what you want?
    – dirkt
    Mar 14 '17 at 10:21

If eth0 has then you've already got NAT somewhere in the equation, either as CGNAT (in which case maybe consider changing ISP) or inside the cable modem. If tun0 has 60.* then it's using a public IP address.

You can definitely forward traffic between interfaces without NAT. It's called forwarding.

sysctl -w net.ipv4.ip_forward = 1

You also need to set up the routing so that your cable modem knows not only about its directly connected subnet but also the other subnets in your network, principally

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.