I'm trying to setup proper ip forwarding within a DHCP subnet generated through a host with two different netowrk adapters.

My current situation is the following:

  1. First node with two networks adapters, the first one connected to a WAN, the second one responsible for generating a subnet through DHCP. Here the DHCP configuration (the host identified as master should be the gateway):

    subnet netmask {
    interface                       enp0s31f6;
    option routers        ;
    option subnet-mask    ;
    option domain-search            "net.local";
    option broadcast-address;
    option domain-name-servers;
    host master{
    hardware ethernet d4:5d:df:1a:26:40;
    host node01 {
    hardware ethernet d4:5d:df:13:69:42;
    host node02{
    hardware ethernet d4:5d:df:13:69:45;
  2. Added iptables rules following the answer provided here

The nodes get the IP correctly and I can ssh to them. Ping to external hosts works fine, but when I try to resolve a host name I get name or service unknown error. Is it possibile that I have to set up IP tables rules even for DNS lookup?

Thank in advance!

EDIT: Trying to CURL a GOOGLE IP directly I got No route to host anyway curl curl: (7) Failed connect to; No route to host while if I ping it everything works as expected ping PING ( 56(84) bytes of data. 64 bytes from icmp_seq=1 ttl=54 time=23.7 ms 64 bytes from icmp_seq=2 ttl=54 time=20.0 ms 64 bytes from icmp_seq=3 ttl=54 time=19.9 ms

closed as off-topic by Jeff Schaller, msp9011, slm Aug 13 '18 at 11:42

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Jeff Schaller, msp9011, slm
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    The .local domain name is a bit special. Are you using mDNS? Is this question/answer relevant to you? – Kusalananda Aug 10 '18 at 10:13
  • Hi @Kusalananda thanks for the answer! I'm not using mDNS but I've tried anyway to remove the domain-search but, unfortunately, the problem remains. I'm wondering if the problem can be due to the fact that the gateway IP is providedly statically by the DHCP server and not taken statically by the node itself – luke035 Aug 10 '18 at 10:20
  • If pinging works from whereever you do the DNS lookup, then IP addresses or routing can't be the problem. Instead, debug the DNS lookup (check resolv.conf, use host/dig to contact the nameserver directly, etc.) – dirkt Aug 10 '18 at 12:02
  • Hi @dirkt pinging works and /etc/resolve.conf shows as domain server but lookup doesn't work. I also tried to resolve google ip and tried to curl the ip (curl in order to overcome the DNS resolution and I got Failed connect to; No route to host – luke035 Aug 10 '18 at 12:42
  • (1) Use host / dig to do a direct DNS lookup without the resolver, using as NS. (2) Check nsswitch.conf. (3) If works, but doesn't, check routes with ip route, ip route get, ip route get; possibly on upstream routers as well. – dirkt Aug 10 '18 at 12:50

After some digging in Google I managed to find the problem: firewalld ( on the gateway was blocking requests ignoring the forward rule (probably there was another rule that was overcoming the forward rule).

Inserting the rule at the beginning made the trick iptables -I FORWARD -i <LAN_ETH> -o <WAN_ETH> -j ACCEPT

Not the answer you're looking for? Browse other questions tagged or ask your own question.