1

I have linux box. and it have two interface(eth0, eth1).

eth0 is upside and eth1 is downside connection.

eth0, eth1 is connected with each switch(s/w0, s/w1).

s/w0 is going out to internet, and s/w1 is connected with one laptop.

And I want eth0 , eth1 two-way forwarding like bridge.

But not using brctl, only using iptables.

So, if iptables rule set is correct, then laptop should be internet enabled.

I've tried this rules, but not working.

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

I'd appreciate any help.

EDIT.

my network is like below.

internet - router - switch0 - eth0:linuxBox:eth1 - switch1 - laptop

When make bridge using brctl like below, laptop can use the internet

brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1
brctl stp br0 off
ifconfig br0 up

My goal is make iptables rules to replace the brctl.

Improve this question

2 Answers 2

Reset to default
1

You should specify what You want. A bridge does no NAT and Internet does not work like Ethernet were a bridge works.
If You want to have an internet gateway with Nat and forwarding Your packages according to Your Linux boxs IP routing tables Your iptables routes look quite fine. You just need to ensure IP forwarding is enabled on that box and the laptop has it's default gateway set to address of linux box's eth1.

So after Your updates: You do not need a bridge. Gateway is sufficient.
1. make sure the interfaces of linux box are in distinct subnets. Or alternatively ensure in it's routing tables that it has the default route on eth0 via gateway internet router and the other traffic for local network (where Your Laptop is in for example) is sent out in eth1.
2, make a static IP configuration on Your laptop with an IP in same network as eth1 and with default router set to interface address if eth1. Or configure a dhcp server on Linux box for the same.
3. Make sure IP forwarding is enabled on Your Linux box.

Improve this answer
3
  • appreciate your comment, and I added some more information. I want replace brctl
    – hybang
    Nov 27, 2019 at 7:57
  • Point 3 should be emphasized. Check the sysctl "forwarding" settings; they default to disallowing forwarding.
    – stolenmoment
    Nov 28, 2019 at 14:30
  • Yes but till now it sounds he expects the linux gateway to act like a bridge so to use his routers DHCP for Laptop and let the laptop talk (bridged) to the internetrouter using as at gateway (not knowing about the Linux box in between). That is what I would first emphasis
    – user301446
    Nov 28, 2019 at 18:21
0

you can try

iptables –t nat –A POSTROUTING –o eth0 –j MASQUERADE
iptables –A FORWARD –i eth0 –o eth1 –m state  --state RELATED,ESTABLISHED –j ACCEPT
iptables –A FORWARD –i eth1 –o eth0 –j ACCEPT

then save the ip tables rules

iptables-save
iptables-save > /etc/sysconfig/iptables
systemctl restart iptables.service

then open the iptables file and edit the rules , move these rules above the reject rules

iptables –A FORWARD –i eth0 –o eth1 –m state  --state RELATED,ESTABLISHED –j ACCEPT
iptables –A FORWARD –i eth1 –o eth0 –j ACCEPT
A FORWARD -o vibr0 -j REJECT --reject-with icmp-port-unreachable
A FORWARD -i vibr0 -j REJECT --reject-with icmp-port-unreachable
Improve this answer
2
  • Thanks for comment, I reinstalled my linux box, and tried your answer. and it still not working. What about the REDIRECT option in my situation?
    – hybang
    Nov 28, 2019 at 2:33
  • Of course still this routes do not make the linux box act as a bridge but make it act as a gateway. Same as it was initially set up.
    – user301446
    Nov 28, 2019 at 6:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .