Given: I have a machine (HostA) with only one NIC which has Internet connectivity. I have another machine (HostB) with one NIC on the same switch. HostB is not configured for Internet access yet. HostA has its default gateway and DNS servers appropriately configured. IPv4 is being used. OSes on the hosts are Ubuntu 13 and Fedora17.

What I want: Now, I would like HostB to have Internet connectivity, too. Is this possible using 'some' combination of iptables, virtual tun/tap devices, or a VPN setup between HostA and HostB, etc?

What I already know and can do: Currently, I can use an ssh-based SOCKS proxy on HostB (ssh -D 9050 UserA@HostA) and route traffic of select 'socksifiable' applications on HostB via this proxy to HostA and beyond. However, sadly, not all applications are socksifiable. Now, I know very well that if HostA had 2 NICs, I could have used some iptables rules to convert HostA into a gateway that would then route traffic between its NIC-1 and NIC-2 (where NIC-1 would be connected to HostB and NIC-2 to Internet). But installing another NIC in HostA is not feasible for me.

PS: I had posted this earlier on superuser.com but got no useful information.

edit 1:

network information

Host A:

:> ip addr
2: p4p1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether d4:be:d9:d5:46:05 brd ff:ff:ff:ff:ff:ff
inet brd scope global p4p1 

:> ip route
default via dev p4p1 proto static dev p4p1 proto kernel scope link src

Host B:

:> ip addr
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 30:f9:ed:d9:2e:20 brd ff:ff:ff:ff:ff:ff
inet brd scope global eth0 

:> ip route dev eth0 scope link metric 1000 dev eth0 proto kernel scope link src metric 1

1 Answer 1


Routing is about "where (and if) to send to". That's not limited to selecting a NIC. In your case routing is very simple though.

You need masquerading in its most simple form (all commands on host A):

iptables -t nat -I POSTROUTING -s -j MASQUERADE

And maybe (if not yet) you need allow forwarding:

iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD 2 -s -j ACCEPT

Assuming host A is configured as the default gateway for Host B.

Edit 1:

After a chat discussion the situation has become clearer. In theory configuring the default gateway on B should have been enough. But it seems that the gateway (which is not under the control of the questioner) blocks host B. Thus the masquerading solution was necessary.

  • Thanks, for enlightening this routing-newbie. I will try out your solution soon enough and let you know. Meanwhile, I ran into tun2socks that is part of the BadVPN tool. Would greatly appreciate your opinion on this program vs. your solution... as, once again, I'm a routing/networking-newbie.
    – Harry
    Commented May 18, 2013 at 14:18
  • 1
    @Harry I cannot really comment on this program as I don't know it. But "VPN" sounds like configuration effort and CPU load which you both don't need. VPNs are not used to enable connectivity; they are used to enable security. You asked for connectivity. Commented May 18, 2013 at 14:50
  • Your solution didn't work. I set up A to be the default gwy on B. Then, I tried the 1st iptables command. When it didn't work, I tried the 2nd and 3rd ones also... which didn't work either. What do I do now?
    – Harry
    Commented May 19, 2013 at 5:12
  • 1
    @Harry Strange. I guess you have to use tcpdump on A then to have a look what happens to the packets. Do they arrive at A, do they leave with the source address rewritten to A, do responses arrive from the Internet? Commented May 19, 2013 at 5:16
  • 1
    @Harry Assumed you ping from B and the A interface is eth0 then you need: tcpdump -i eth0 -n host Commented May 19, 2013 at 6:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .