I have read many other posts but cannot figure this out.

eth0 is my external connected to a Comcast modem. The server has internet access with no issues.

eth1 is internal and running DHCP for the clients. I have DHCP working just fine, all my clients can get an IP and ping the server but they cannot access the internet.

I am using ISC-DHCP-SERVER and have set /etc/default/isc-dhcp-server to INTERFACE="eht1"

Here is my dhcpd.conf file located in /etc/dhcp/dhcpd.conf

ddns-update-style interim;
ignore client-updates;

subnet netmask {
option routers;
option subnet-mask;
option domain-name-servers,; #OpenDNS
#   option domain-name "example.com";
default-lease-time 21600;
max-lease-time 43200;


I have made the net.ipv4.ip_forward=1 change in /etc/sysctl.conf

here is my interfaces file:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

iface eth1 inet static

auto eth1

And finally- here is my iptables.conf file:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
#-A PREROUTING -i eth0 -p tcp --dport 59668 -j DNAT --to-destination
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
-A FORWARD -s -o eth0 -j ACCEPT
-A FORWARD -d -m state --state ESTABLISHED,RELATED -i eth0 -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
#-A FORWARD -i eth0 -m state --state NEW -m tcp -p tcp -d --dport 59668 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

I am completely stuck. I cannot figure out why the clients cannot access the internet. Am I missing a service? Is a service not running? Any help would be greatly appreciated. I tried to be as thorough as possible but please let me know if I have missed something. Thank you!

  • I did it once with Shorewall, wasn't that complicated. This is the main tutorial you want to follow: shorewall.net/two-interface.htm – slhck Oct 12 '11 at 22:32
  • This depends a bit on your external modem. Do you know whether the modem is connected in bridge mode or routed mode to the ubuntu box? – Paul Oct 12 '11 at 22:58
  • so I am sorry about the delayed response. I had to leave town unexpectedly. I am working with shorewall right now and I will let you know how it goes... Shorewall seems to be different than iptables... is it really a frontend for it or a separate system? Thanks! – Siriss Oct 17 '11 at 3:52

The issue lies in my iptables although I am not sure where. A clean sweep fixed it given to be my a gentleman on ubuntu forums.

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -j ACCEPT

I hope this helps others! I now have to add each rule one by one again. Thank you all for the help.

Also, you should save your iptables iptables-save > /somewhere/iptables.conf(or some filename) and then add a pre-up iptables-restore < /somewhere/iptables.conf (or whatever) under eth0 in /etc/network/interfaces. This will make sure the rule list is loaded before the nic is active. Make sure to re-save when you make changes to iptables.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.