I'm having a hard time figuring out how to set this up right. I can barely formulate a google query that explains it, so I'll try to do my best.

I have a Ubuntu PC with two NIC cards.

eth0 ( goes to the main default gateway and out to the internet, and
eth1 ( goes to a network switch with a bunch of IP cams connected to it.

I've enabled IP forwarding and iptables rules and hosts on the router PC. Hosts inside the eth1 network can reach the internet and can reach other hosts on the eth0 network. So this is good.

What I'm trying to do now, is get hosts inside the eth0 network to be able to access the hosts inside the eth1 network.

The computers are on eth0 network but the network cameras are on eth1 network. A single computer with two NIC cards acts as the bridge. Ultimately I want the computers on eth0 to be able to see the IP cameras on eth1.

Trying to map it out: hosts on should be able to see hosts on but can't.

hosts on CAN see hosts on (these hosts can also get out to the internet). So all good here.

So far I have these IP rules and these have allowed the eth1 network to get out.

iptables --table nat --append POSTROUTING --out-interface enp1s0 -j MASQUERADE
iptables --append FORWARD --in-interface enp3s0 -j ACCEPT

I guess my question is: how can the eth0 network get to hosts in the eth1 network?

Do I have to add routes on the individual computers that want to access the eth1 network?

Do I need to set up forwarding between the eth0 & eth1 interfaces on the router PC?

Here's my current add route command, /etc/network/interfaces and iptables rules:

(On macos:)
sudo route -n add -net

(on two-NIC PC) /etc/network/interfaces #primary interface enp3s0 auto enp1s0 iface enp1s0 inet static address netmask network gateway dns-nameservers

#secondary interface enp3s0 auto enp3s0 iface enp3s0 inet static address netmask broadcast network

(on two-NIC PC) iptables -t filter -A FORWARD -i enp1s0 -o enp3s0 -j ACCEPT iptables -t filter -A FORWARD -i enp3s0 -o enp1s0 -j ACCEPT iptables -t nat -A POSTROUTING -j MASQUERADE


2 Answers 2


Your issue is mainly the route configuration of the hosts. I assume your current setup is as follow:

  • enp1s0 interface has ip address
  • enp3s0 interface has ip address

For hosts between the two IP network to communicate, they need a dedicated entry in their routing table.

  1. The hosts on that need to access the IP camera need to know that is the router for
  2. The hosts on need a route to

Now I assume that the static/DHCP configuration for the IP cameras is to route default traffic through, so they know where to send packets for the PCs. But the PCs on have only one default entry the internet router. So any packet to get sent there and lost.

You can either

  • configure your DHCP router on to advertise a static route to via with the "classless static route" option
  • add manually as a gateway to on the PCs

You will also need to flush your iptables rules. The POSTROUTING rule will mess up the routing and the FORWARD rule is useless (unless you have a DROP policy).

iptables -t nat -F POSTROUTING
iptables -F FORWARD

Your cameras could see the PCs because they were configured with a default gateway of and the nat POSTROUTING entry. For example if IP camera sends a packet to PC, the packet will first be sent to (enp3s0) the default gateway. The Ubuntu PC will forward the packet to enp1s0, rewriting the sender's address as its own, When replies the packet, it sends it back to the substituted address, When the Ubuntu PC receives it, it knows it is a reply to the IP camera So it rewrites the destination address to and fowards it through enp3s0.

Now you don't want to mess packets with NAT, you just need IP routing. In the preceding example, the PC sees the camera IP address as, as it was substituted by the Ubuntu PC. Once you have set correct routes,

  • in a connection initiated by the PC to the camera, the PC will see the camera IP address as
  • in a connection initiated by the camera to the PC, the PC will still see the camera IP address as (NAT'ed address)

For simple IP devices, the second is unlikely to matter. But that could lead to buggy behaviour. As an example, if you had a managed switch and you wanted to use SNMP traps. You should delete the iptables -t nat -A POSTROUTING -j MASQUERADE rule.

One issue that will arise: Do you want your IP cameras to access the internet? If not, I would include an iptables FORWARD route to deny packets from going anywhere except If you wish to grant access, you will need to configure your router with a static route to

  • I tried to explain in more detail why the NAT rule should be discarded - bottom of the post.
    – jaem
    Commented Dec 9, 2017 at 10:38

Example sub-net addresses and names

net “main” ( – enp1s0

net “cameras” 192.168.176/24 ( – enp3s0

You are forwarding from “cameras” to "main" with:

iptables --table nat --append POSTROUTING --out-interface enp1s0 -j MASQUERADE

iptables --append FORWARD --in-interface enp3s0 -j ACCEPT

main has a default gateway that “routes” traffic to the local subnet or the internet.

If you added the opposite rules to the bridge:

iptables --table nat --append POSTROUTING --out-interface enp3s0 -j MASQUERADE

iptables --append FORWARD --in-interface enp1s0 -j ACCEPT


Add a route in the default gateway on “main” to the bridge computer for the sub-net

wrong syntax but you get the idea

route add -net gateway “bridge computer”

I think that will accomplish what you want without adding or changing gateways info on the cameras.

  • mmmmm, I should have read your question better.
    – jc__
    Commented Dec 7, 2017 at 21:59
  • Thanks your message helped me a lot with understanding, but I am not quite there yet. To make it easier I've copied my current /etc/networking/interfaces, iptables and route add commands. I still haven't been able to get it to work, but I think I'm close.
    – Mike
    Commented Dec 7, 2017 at 22:10
  • i edited my original question to show the routing command I'm adding to my mac, the network/interfaces file and iptables for the router PC. currently when I ping anything on the eth1/176 network it says network unreachable.
    – Mike
    Commented Dec 7, 2017 at 22:19
  • I must go now and will not be back until tomorrow, but I think you are almost there. Just add a route on your default gateway for the 'other' sub net because all traffic will go through it (default gateway).
    – jc__
    Commented Dec 7, 2017 at 22:23
  • I hope its okay to delete the answer and change it...
    – jc__
    Commented Dec 7, 2017 at 22:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .