This question already has an answer here:

I have a Linux machine (which I want to use as a gateway) and two other machines A and B. Gateway machine has eth0, eth1, and eth2. eth1 connects to machine A and eth2 connects to machine B. I want to be able to ping from A to B and the other way around. I tried to do it using iptables, and added FOWARDING rules:

iptables -A FORWARD -i eth1 -o eth2 -j ACCEPT
iptables -A FORWARD -i eth2 -o eth1 -j ACCEPT

But I am getting "host is unreachable" when trying to ping.

When I run

iptables -L -n -V

I can see that the forwarding rules got 0 packets and 0 bytes. Now I know I might missing a few more things, but it looks like the FORWARDING chain is never reached. When according to documentation if it’s not the destination it will go to FORWARDING chain.

i cleaned the iptables and started from scratch using the following commnads

    iptables -A FORWARD  -i eth1 -o eth2 -j ACCEPT
    iptables -A FORWARD  -i eth2 -o eth1 -j ACCEPT

    iptables -t nat -A PREROUTING -i eth1 -j DNAT --to-destination y.y.y.y
    iptables -t nat -A PREROUTING -i eth2 -j DNAT --to-destination x.x.x.x

    iptables -t nat -A POSTROUTING -o eth2 -d y.y.y.y -j SNAT --to-source x.x.x.x
    iptables -t nat -A POSTROUTING -o eth1 -d x.x.x.x -j SNAT --to-source y.y.y.y

Still getting "network is unreachable"

marked as duplicate by sebasth, Thomas, Isaac, Thomas Dickey, DarkHeart Sep 16 '18 at 1:25

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 3
    Read about masquerading and routing. – Tomasz Sep 14 '18 at 1:12
  • I know i need to use nat rules but even without it i should see packets getting to the FORWARD chain – Gigalala Sep 14 '18 at 1:57

Your misconception is that you seem to think that iptables does the forwarding.

The rules you used in the first example merely allow forwarding. Forwarding is already allowed by default, so these rules make sense only as exceptions to a general deny rule that comes later.

You just have to enable packet forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward

Of course, your gateway should be the default gateway for both A and B, or at least it must be the gateway to reach each other. So if it doesn't work with forwarding enabled, you should include the routing tables on all three machines.

Not the answer you're looking for? Browse other questions tagged or ask your own question.