I have a Ubuntu box with eth0 and eth1.

How can I redirect all the traffic coming from eth0 to eth1 and back?

Should I do DNAT and SNAT like below or just forwarding or both ?


My case is like this A-B-C, 3 machines. Both A & C in different network. B have two nic one is A's network (eth0) and other in B's network (eth1). I can't set B as the gateway in A nor B.

Below is how this was achieved by iptables on host B: SOLUTION

iptables -t nat -A PREROUTING -p tcp -m tcp ! --dport 22 -j DNAT --to-destination eth1IP
iptables -t nat -A POSTROUTING -p tcp -m tcp -o eth1 -j MASQUERADE

Have excluded port 22 so that SSH traffic is spared from the rules and my ssh to host C works.

  • Are those different Ethernet ports using different hardware?
    – Biswapriyo
    Commented Jun 13, 2017 at 8:15
  • 2
    Why do you want to do this?
    – Seth
    Commented Jun 13, 2017 at 8:49
  • Both are in different network. A --- B --- C. A and B(eth0) in same network. B(eth1) and C in same network. If A wants to talks to C then it's only possible via B.
    – nkg
    Commented Jun 13, 2017 at 8:53
  • If you can't change the routing tables on A and C, then you can't get either of them to send their traffic for each other by way of B, even if you had B acting as an IP forwarding router. But what about the default gateways on the networks that A and C are on…can you change the routes on those gateways? If those gateways each know that B provides a route to the other subnet, then those other gateways can ensure that traffic between A and C gets rerouted through B.
    – Spiff
    Commented Dec 4, 2022 at 5:31

1 Answer 1


Provided the netmasks are correct and do not overlap, you do not need to use DNAT or SNAT, you simply need to ensure that:

  1. Each computer has a default gateway set through the Linux box, or has a route to the other network via the Linux box.

  2. The Linux box has forwarding enabled – uncomment net.ipv4.ip_fortward in /etc/sysctl.conf and reboot (or echo 1 > /proc/sys/net/ipv4/ip_forward to do it temporarily).

  3. Ensure the firewall allows forwarding (iptables -vnL and check that the FORWARDING rule has no chains and is set to default ACCEPT). This is, I believe the default.

  • I can't change the default gateway in other machine.
    – nkg
    Commented Jun 13, 2017 at 11:11
  • 1
    Why not bridge eth0 and eth1 so they appear as a single network?
    – davidgo
    Commented Mar 25, 2019 at 4:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .