Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

These are the rules I am using:

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface wlan5 -j MASQUERADE
iptables --append FORWARD --in-interface wlan3 -j ACCEPT

I have wlan5 with, and wlan3 with I make my laptop a wifi repeater with 2 wifi cards.

So people connect to wlan3, the gateway is, and everything redirects to wlan5 [gw].

Now, this is working great, except I cannot access a local HTTP server hosted on my laptop. It is hosted on my laptop, and it works as localhost, or

$ curl -I
HTTP/1.1 301 Moved Permanently
Date: Tue, 26 Feb 2013 02:35:32 GMT
Server: Apache/2.2.22 (Ubuntu)
Vary: Accept-Encoding
Content-Type: text/html; charset=iso-8859-1

Ok, so here is where the problem comes up. A client on my sharing network [wlan3] with IP tries to access and it cannot connect:

$ wget                                       
Connecting to (
wget: can't connect to remote host ( Connection refused

It can ping and even ping external IP. so it has internet connection, which is the point, but it cannot access the HTTP, I believe because of the iptables rules. right after the error, I get this on my laptop syslog:

Feb 25 21:36:19 toshi kernel: [57806.285170] Inbound IN=wlan3 OUT= MAC=9c:b7:0d:a5:45:67:a8:26:d9:3e:04:21:08:00 SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=28282 DF PROTO=TCP SPT=58343 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 

So the question is, how can I exclude forwarding IP requests to not forward to wlan5?


share|improve this question
Are you sure there's no active firewall (ufw, etc...)? The syslog line you posted is an iptables log that is only pushed to syslog if there's a -j LOG target. Your iptables commands flush all rules and delete all custom chains, so nothing should be logged. Can you post the output of sudo iptables-save. – Eric Carvalho Feb 26 '13 at 18:28 Thanks. – Matt Feb 27 '13 at 3:00
Actually, I found out that it was working after I did that paste. But later it stopped again so here is a [bigger output] paste: – Matt Feb 27 '13 at 5:40
You do have a firewall program that automatically configures iptables. Don't you remember to enable any firewall? The most common, and disabled by default, is ufw. Run sudo ufw status to check if it is enabled, and sudo ufw disable to disable it. – Eric Carvalho Feb 27 '13 at 16:21
It says "Status: inactive".. – Matt Feb 27 '13 at 18:49

edit: once again, after I thought the problem was fixed, it just stopped working again without me issuing NO more iptables commands. I cannot figure out why it keeps working, and then not working. >.<

I found a different iptables command that works to share my internet from 1 [long range] wifi device to another [internal]:

iptables -t nat -A POSTROUTING -o wlan5 -j MASQUERADE

instead of the iptables commands in the question. And this makes it so I can still access internet, and still access http/ssh on from

share|improve this answer
This is happening because some (firewall?) program is automatically setting iptables rules. You only have to discover which program is "messing" with iptables. Run dpkg -l | grep -i firewall, maybe it'll show something related to firewall programs. – Eric Carvalho Feb 27 '13 at 23:46
All that shows up is ufw [which is disabled] and firestarter. But firestarter is not running. Also I use wicd to connect to wifi. It seems to me: when I'm not connected, run the iptables rules run hostapd, the connection works [with wlan3]. But when I connect to internet on wlan5, then iptabes-save is a few times longer with lots of rules with IP addresses that were not there before. – Matt Mar 2 '13 at 19:20

The iptables-save output you posted shows the following custom chains in the filter table: INBOUND, OUTBOUND, LOG_FILTER, LSI and LSO. Firestarter creates 5 chains, all named exactly like that.

I'm sure your problem is caused by Firestarter. Open it and check if it's really disabled.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.