So I am trying to set up a dual homed BRO IDS box to act as a gateway(?) server between my home network and the existing el cheapo router that came with the broadband. what I have is this... (pipes represent wire, sorry for poor formatting)

ADSL Router running DHCP  (gateway is  
eth0 (  
ubuntu 1404 server running bro IDS, running bind9,   
it serves DHCP on network only on eth1  
eth1 (  
Internal LAN running two Apple Airports in bridge mode  

I have set things up correctly I feel, but the Ubuntu Server doesn't route. I can SSH on it and ping both interfaces from it, plus ping the Internet. However hosts on either of the LANs cannot route to the other side of the Ubuntu server.

Here is the output of routes -n

Kernel IP routing tableico /etc/network/interfaces
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         UG    0      0        0 eth0   U     0      0        0 eth0   U     0      0        0 eth1

and here is the content of /etc/interfaces

auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
 auto eth1   
 iface eth1 inet static  

I enabled ipv4 ipforwarding using sysctl. The Ubuntu DHCP server is configured to only serve Ip addresses, and it works well. There is another DHCP router serving eth0 ( which I've kept active to be able to use the wifi on the broadband router to browse the web while working the problem.

But in any event I have still failed to be able to ping the other side of the Ubuntu box after logging in to both sides with static and dynamically assigned IPs. can post the contents of dhcpd.conf too...?

Am I missing something simple? Are there any troubleshooting steps I can take on the Ubuntu box to verify narrow down the problem. Currently I just get 'no route found / exists' messages... Here's the /etc/dhcpd.conf particulars too...

ddns-update-style none;  
default-lease-time 600;  
max-lease-time 7200;  
subnet netmask {  
option routers;  
option broadcast-address;  
option domain-name-servers,;  

This is the output from ping across router

Request timeout for icmp_seq 0  
Request timeout for icmp_seq 1  
Request timeout for icmp_seq 2  

Also, while configuring it, I set it up as a bridge initially, but that configuration was removed from interfaces ages ago (it didn't work at all)

As requested, here is the output from iptables -L

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

  • iptables for NAT and masquerading?
    – ssnobody
    Jun 3 '15 at 0:47
  • I switched on masquerading as a last resort yesterday, rebooted and no change. IPtables is in it's default state - I have updated the question to show output from iptables -L Jun 3 '15 at 7:30

There are a few things that do not appear clear, at least to me at first sight.

  1. The following line in /etc/dhcpd.conf is surely wrong:

    option routers;

it should be

  option routers

Currently, you are basically telling your DHCP clients that their default gateway is on a different subnet than theirs: how do you expect them to be able to reach said gateway? The correct address for the gateway you pass to the clients is the LAN interface of the router.

  1. When you say you cannot ping from DHCP clients, did you try with a name (e.g. www.google.com) or with an IP (e.g. It makes a difference because you said nothing about DNS resolution, so it might happen that

    ping -c1

gets a reply, while

   ping -c1 www.google.com

does not. If this is the case, you are only missing the following two lines in /etc/resolv.conf:


If this is not the case, pls read on.

  1. What you say about iptables is not fully consistent, because you claim you have added the rule for NATting in iptables, but then you display the existing iptables rule for the filter table, not the nat table. So, please issue the following command

    iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

and then, without rebooting, try issuing the same ping commands as above.

If all of this fails, then please open two terminals on the Ubuntu machine, and issue the following two commans: in terminal 1,

  tcpdump -i eth0 -n icmp

and in terminal 2

  tcpdump -i eth1 -n icmp

then go to one of the DHCP clients, and try one of the ping commands above. If everything works, you should see both ping and its reply fly through both terminals. If you do not, please paste the output for another round of help.

  • Awesome, Marius, you have fixed it, and helped me understand the problem and troubleshooting. Kudos, man. I changed the incorrect DG this morning (took a while to propagate I guess, didnt work immediately) and then I changed Iptables with the command suggested, and the whole setup has snapped into place after three days struggle. The Airport routers are now serving the 'safe' network. BTW apologies for not mentioning DNS in more detail in the question (resolv.conf has been correct for days) Jun 3 '15 at 16:38
  • BTW I'm a newb here, is there anything I can do to make yours the 'winning' answer - I dont have enough credit to upvote yet! Jun 3 '15 at 16:43

Your Ubuntu router is routing just fine. That's not the problem. The problem is that your configuration can't work because the ADSL router has no idea how to reach machines on the 192.168.2.x network. Also, no device is configured to do NAT for the 192.168.2.x network. So your configuration just doesn't make sense.

So, for exaample, say pings The Ubuntu server routes it along its default route just fine. But then the ADSL router receives a packet from to on its LAN interface and has no idea what to do with it.

Update: To see just one problem, consider the routing table on the ADSL router. The only local route it has is for to the LAN. Every other route goes to the link to your ISP. So when it handles a packet to, its routing table says to send that packet out to the Internet. That clearly won't work.

  • Thanks v much for the analysis, however NAT is being performed by the ADSL router. Also, I cannot ping the 192.168.1 network from 192.168.2 (and vice versa) and the ADSL router would not be involved in that? Would youj mind expanding your answer, I'm not sure I'm quite understanding it? Thanks again for replying! Jun 3 '15 at 8:57
  • NAT is being performed by the ADSL router for the network. It doesn't even know how to reach hosts in the network, nor would it have any reason to NAT for them (any more than it would NAT for any other address not on its LAN). Jun 3 '15 at 9:43
  • Of course you can't ping -- the ADSL router has no idea how to reach hosts on the network. Why would it send those packets to the Ubuntu server? You're expecting routing to do magic. (Imagine the router is trying to route a packet to -- what do you think it would do with it and why? Hint: The only route it matches is its default route out to the Internet!) Jun 3 '15 at 9:45
  • "It doesn't even know how to reach hosts in the network" Thats a fair point - I had overlooked that. Jun 3 '15 at 17:01
  • And the next part is that even if it did know how to reach them, it wouldn't know that it was supposed to NAT for them. So the problem is that the Ubuntu server is routing just fine, but that's not what it needs to do. Jun 3 '15 at 18:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.