Skip to content

Configure traffic forwarding on Linux

Apply configuration

Note

This guide shows how to achieve traffic forwarding on Linux using iptables with the default network interface eth0. Consult your operating system documentation for more information.

  1. Enable IPv4 traffic forwarding: 

    sudo sysctl net.ipv4.ip_forward=1

  2. Find the default network interface for your device (other commands such as ifconfig are available): 

    ip link show

  3. Record the default network interface for use in subsequent commands. In this example, eth0 is used: 

    export DEFAULT_NET_IF=eth0

  4. Masquerade traffic to make it appear it is coming from the LAN rather than the TAN: 

    sudo iptables -t nat -A POSTROUTING -o $DEFAULT_NET_IF -j MASQUERADE

  5. Accept forwarding requests from the connect interface to LAN: 

    sudo iptables -A FORWARD -i connect -o $DEFAULT_NET_IF -j ACCEPT

  6. Accept forwarding requests subject to connection tracking: 

    sudo iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

Make configuration persistent

The routing configuration must be made persistent to avoid needing to manually re-apply it following a system reboot.

Once the configuration has been applied and tested, make it permanent as follows:

For sysctl, add the following entry to /etc/sysctl.conf (there may be an existing entry you can uncomment): 

net.ipv4.ip_forward=1

For iptables, run the following commands to save the current rules: 

sudo mkdir -p /etc/iptables/
sudo iptables-save | sudo tee /etc/iptables/rules.v4

If your iptables rules are not automatically restored when you reboot, cron may be used to restore them. Add an entry to the root crontab, with sudo crontab -e: 

@reboot /usr/bin/sleep 30 && /usr/sbin/iptables-restore < /etc/iptables/rules.v4

See man sysctl.conf and man iptables-save for more information.

For Ubuntu and Ubuntu-based distributions, the iptables-persistent package may be installed. This is in addition to iptables-save: 

sudo apt install iptables-persistent

On RedHat and derived-distributions, enable the iptables service: 

chkconfig iptables on

For more information, see Saving Iptables Firewall Rules Permanently.