I want to setup my ubuntu computer to route packets. Therefore I've read several tutorials which always had many rules to add to iptables.

I finally found out, that the only rule needed (given that iptables is otherwise completely empty) to route packets is the following:

iptables -t nat -A POSTROUTING -o <ext> -j MASQUERADE

in which ext is the network interface where packets are going outwards.

I don't really understand what this rule really does and why it only takes this single rule to make IP forwarding work.



iptables -t nat -A POSTROUTING -o <ext> -j MASQUERADE


  • -t nat:

    -t: For table

    NAT, or network address translation, is a general term for mangling packets in order to redirect them to an alternative address. Usually, this is used to allow traffic to transcend network boundaries. A host that implements NAT typically has access to two or more networks and is configured to route traffic between them. Used to translatethe packet’s source field or destination field


    specifies the built-in POSTROUTING chain to "append" the rule to

    chain: Rule set found in the NAT table


    The -j MASQUERADE target is specified to mask the private IP address of a node with the external IP address of the firewall/gateway.

  • -o <interface>:

    The firewall's external networking device


  • -t nat select table "nat" for configuration of NAT rules.
  • -A POSTROUTING Append a rule to the POSTROUTING chain (-A stands for "append").
  • -o eth1 this rule is valid for packets that leave on this network interface (-o stands for "output")
  • -j MASQUERADE the action that should take place is to 'masquerade' packets, i.e. replacing the sender's address by the router's address.





| improve this answer | |
  • Thank you very much for your answer! But can you explain, why routing is only possible if I specify this particular rule? – Codey Dec 12 '18 at 20:05
  • 1
    Because you're routing and not forwarding packets. Routing send packets meant for you while forwarding the packets aren't meant for the destination in question. Simply put "iptables send packets meant for me else where"! Note appending a forwarding rule won't do what you want! – George Udosen Dec 12 '18 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.