Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have iptables running on a host (acting as a firewall) in a Linux namespace with only one network interface: h2-eth1 (has an IP and MAC address)

I have set up my switch to forward all packets to the firewall, and the packets returned from the firewall to the internal network. Now, I proceed to do a simple sanity check to see if everything is working. I run these commands on the firewall:

$sudo bash -c 'echo 1 > /proc/sys/net/ipv4/ip_forward'
$iptables -P INPUT ACCEPT
$iptables -P FORWARD DROP
$iptables -P OUTPUT ACCEPT

$iptables -F INPUT 
$iptables -F FORWARD 
$iptables -F OUTPUT 
$iptables -F -t nat

$iptables -A FORWARD -i h2-eth1 -o h2-eth1 -j ACCEPT

Now, I ping an internal host from outside. I see ICMP packets going to the firewall but none coming back from it. So, I ran iptables -nvL on the firewall and I see all tables (INPUT, OUTPUT, and FORWARD) have packet count 0. So, the packets are not reaching iptables because they don't match the IP address of the NIC? How do I correct this?

share|improve this question

By setting up a DNAT. All you are doing at the moment is passing everything to the INPUT chain on your firewall. You can't just "ping an internal host from outside" because outside knows nothing about the inner network because the internal addresses aren't public.

Example: Hosting a webserver in the LAN you want visible to WAN (Internet)

iptables -t nat -A PREROUTING -p tcp -d <FIREWALL EXTERNAL IP> --dport 80 -j DNAT --to-destination <INTERNAL HOST IP>:80

This will make it appear that the firewall is hosting a webserver but it's actually forwarding everything to an internel server. You have to do this for each service and protocol you want to forward to the internal network.

share|improve this answer
I should have mentioned this but the external host is actually just an internal host in the same subnet. I configure the switches so it is treated as an external host. Anyways that does not explain why I don't see any packets coming out of the firewall – Bruce Mar 24 '13 at 0:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.