Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have read many other posts but cannot figure this out.

eth0 is my external connected to a Comcast modem. The server has internet access with no issues.

eth1 is internal and running DHCP for the clients. I have DHCP working just fine, all my clients can get an IP and ping the server but they cannot access the internet.

I am using ISC-DHCP-SERVER and have set /etc/default/isc-dhcp-server to INTERFACE="eht1"

Here is my dhcpd.conf file located in /etc/dhcp/dhcpd.conf

ddns-update-style interim;
ignore client-updates;

subnet netmask {
option routers;
option subnet-mask;
option domain-name-servers,; #OpenDNS
#   option domain-name "";
default-lease-time 21600;
max-lease-time 43200;


I have made the *net.ipv4.ip_forward=1* change in /etc/sysctl.conf

here is my interfaces file:

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

iface eth1 inet static

auto eth1

And finally- here is my iptables.conf file:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
#-A PREROUTING -i eth0 -p tcp --dport 59668 -j DNAT --to-destination
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT
-A FORWARD -s -o eth0 -j ACCEPT
-A FORWARD -d -m state --state ESTABLISHED,RELATED -i eth0 -j ACCEPT
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
#-A FORWARD -i eth0 -m state --state NEW -m tcp -p tcp -d --dport 59668 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

I am completely stuck. I cannot figure out why the clients cannot access the internet. Am I missing a service? Is a service not running? Any help would be greatly appreciated. I tried to be as thorough as possible but please let me know if I have missed something. Thank you!

share|improve this question
up vote 4 down vote accepted

The issue lies in my iptables although I am not sure where. A clean sweep fixed it given to be my a gentleman on ubuntu forums.

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -j ACCEPT

I hope this helps others! I now have to add each rule one by one again. Thank you all for the help.

Also, you should save your iptables with iptables-save > /somewhere/iptables.conf (or some filename) and then add a pre-up iptables-restore < /somewhere/iptables.conf (or whatever) under eth0 in /etc/network/interfaces.

This will make sure the rule list is loaded before the nic is active. Make sure to re-save when you make changes to iptables.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.