Hello fellow superusers,

I would like to use a Pi (Debian based) as router right behind the modem/router. All LAN traffic will be filtered through the Pi, with a firewall after, not covered here.

So, I have two LANs, an "inner" LAN containing my local machines, and a small LAN between the modem/router and the Pi router.

I have successfully defined the route from the "inner LAN" to the "small LAN" beyond the Pi. My problem is I have a standard Internet modem/router, which I cannot configure routes on using "via". So, to counter this limitation, I thought of enabling NAT passthrough on the Pi's interface connected to the "small LAN" (where the modem is).

I repeat, on one branch I have successfully configured ip route setup, while on the other branch I need NAT passthrough defined at Pi's level.

For NAT I tried using ufw:


'# NAT table rules



'# Forward traffic through eth0 - Change to match you out-interface

-A POSTROUTING -s 192.168.x.x/24 -o eth0 -j MASQUERADE

'# don't delete the 'COMMIT' line or these nat table rules won't

'# be processed


after reboot, disable, enable of ufw I get the following error:

error around "*nat".

actually I don't know if

-A POSTROUTING -s 192.168.x.x/24 -o eth0 -j MASQUERADE

is correct. The interface link is expected to route the traffic through, but I don't konw if it is the source link or the destination link. Anyway, the error might also be elsewhere (around *nat).

Remember, in one direction, WAN to LAN, I need to forward traffic. In the opposite direction I already have routes in place (I can't have the symmetrical because the modem is limited).

Any thoughts?

  • Sounds like it has nothing to do with dhcpcd(.conf) but you are merely looking for a proper way to make iptables rules persistent...
    – Tom Yan
    Nov 13, 2019 at 15:37
  • Literally .x.x?
    – Tom Yan
    Nov 15, 2019 at 1:37
  • /24 doesn't really make sense for (the non-literal) .x.x anyway. It should either be .0.0/16 if you mean "any" by x or .x.x/32 (and /32 can be omitted) if you mean specific numbers by x. (Well, or .x.0/24.)
    – Tom Yan
    Nov 15, 2019 at 1:43
  • Btw, has '# don't delete the 'COMMIT' line or these nat table rules won't '# be processed COMMIT really become one line?
    – Tom Yan
    Nov 15, 2019 at 1:45
  • hi, .x.x means I don't disclose my ips, don't worry. I corrected the line breaks, it was a markdown issue, the original file is correct in syntax regarding your remarks.
    – sugarman
    Nov 15, 2019 at 6:56

2 Answers 2


For addresses, use the static keyword in dhcpcd.conf – you can specify some static parameters while still using DHCP, or you can even specify a static IP address without having dhcpcd request a DHCP lease at all.

For iptables, first check whether the distribution already has its own services for rule persistence. For example, Arch has iptables.service which always loads '/etc/iptables/iptables.rules', while Debian has netfilter-persistent.service which loads (and saves) '/etc/iptables/rules.v4'.

If such a service is not available, write one. It's perfectly fine to add these iptables rules on startup even before IP configuration happens.

And for commands which really need to be run after dhcpcd is done and no sooner, use its hooks feature.

  • thank you for your kind answer @grawity, I have updated the question :-)
    – sugarman
    Nov 14, 2019 at 15:25

good new, I found the problem.

Actually, I needed two COMMIT, one for the first rules and another one for nat rules.


  • It's actually one COMMIT per table...(I assume you have a rule in *filter)
    – Tom Yan
    Nov 15, 2019 at 8:12
  • What's a table?
    – sugarman
    Nov 15, 2019 at 8:19
  • ipset.netfilter.org/iptables.man.html (See about -t)
    – Tom Yan
    Nov 15, 2019 at 8:26
  • ty. My attempt to set up the Pi router as I planned failed. I create another question to focus on the routing issues.
    – sugarman
    Nov 15, 2019 at 8:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .