I am trying to setup Traffic forwarding and NAT for my VM machines.I am having setup in which there are 2 linux OS i.e. Ubuntu and CENTOS and I want that traffic should be forwarded from Ubuntu to CENTOS and it should NAT with another interface of CENTOS.Please find below configuration on CENTOS

ens33 :- Internal Interface
ens34 :- External Interface

CENTOS and Ubuntu are connected (Host adapater in VM).Below output is for CENTOS

root@localhost ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    101    0        0 ens34   U     101    0        0 ens34   U     100    0        0 ens33

I've done below configuration for traffic forwarding and NAT in IPtables on CENTOS


:OUTPUT ACCEPT [269:27758]
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
**-A FORWARD -i ens33 -o ens34 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens34 -o ens33 -j ACCEPT**
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

cat /proc/sys/net/ipv4/ip_forward

I've have verified traffic in which traffic is getting forwarded from Ubuntu to CENTOS but looks like NAT and forwrding is not working (IP address of Ubuntu machine)

03:54:20.331164 IP > ICMP echo request, id 34419, seq 791, length 64
03:54:21.339241 IP > ICMP echo request, id 34419, seq 792, length 64
  • Sorry, but no one can read it if you don't add proper line breaks by formatting. It looks like you've swapped the established/related and unconditional lines. And I am not going to edit it again to figure out if any if the other rules could cause problems. – dirkt Oct 25 '19 at 8:38
  • I've tried to edit it , please help if you are aware about it – JAINIL GAJJAR Oct 25 '19 at 8:44

You've swapped the internal and external interfaces in the FORWARD rules. In your setup,

-A FORWARD -i ens33 -o ens34 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens34 -o ens33 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

an incoming packet from ens33 that wants to open a connection (from the Ubuntu machine, I assume) will match the first line. But there's no established connection, and the packet will get rejected with the last line.

What you need is

-A FORWARD -i ens34 -o ens33 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens33 -o ens34 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

or even better, make a shell script with placeholders like this:

# flush rules
iptables -F FORWARD 
iptables -t nat -F
# rules
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
iptables -A FORWARD -j REJECT --reject-with icmp-host-prohibited
iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE
# more rules if required

Then you can re-use it different situations with different interfaces without getting confused.

I have no idea what are you trying to do in the INPUT chain; I suggest deleting all of those rules to simplify debugging. If forwarding works without those rules and you still need to do something specific in the INPUT chain, please ask a new question.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.