Yes I know again and again ... but I don't see it maybe someone sees my problem. I have to forward a internal Office Network (here which is connected to eth1 ( through the Server with Internet access on (

Here is where I started:


auto eth0
iface eth0 inet static          
    netmask     # we've got only 5 IPs with Internet connection.
    gateway            # the gateway where we get our signal from
    dns-name-servers    # DNS-Server

# OFFICE - DNS-Server running on this iface giving IPs of the network
auto eth1
iface eth1 inet static

route -n

target    Router     Genmask          Flags Metric Ref Use Iface          UG    0      0   0   eth0    U     0      0   0   eth1  U     0      0   0   eth0

Further there is a DHCP-Server running on eth1 with the setup


ddns-update-style none;

option domain-name "example.org";
option domain-name-servers ns1.example.org, ns2.example.org;
default-lease-time 600;
max-lease-time 7200;


log-facility local7;

subnet netmask {
    option subnet-mask;
    option routers; # <- The servers eth1 IP here?

What am I missing?

EDIT: Found out how to add an image ;) I hope this helps understanding My access ends at "My Server"...

  • Don't you need to setup also IP masquerading in iptables ? – marosg Jan 30 '17 at 15:33
  • Is there anything that does not work? As you are on the server, you need no 'Router' to access the attached networks. So the configuration shown in your first call to route -n was correct and sufficient. The the Router column has nothing to do with default route- it just says theat there is no router, but direct attached. default routemeans the target column! – ridgy Jan 30 '17 at 15:34
  • I believe that one problem you might be having is that your Office Network IPs are not set to Private, they are Public. That can cause DNS problems with routing to the internet. Private IPs start with either 10.x.x.x, 172.16.x.x or 192.168.x.x. See here: iplocation.net/public-vs-private-ip-address – Terrance Jan 30 '17 at 15:35
  • @ridgy oh ok so I will remove those again.. well anything that works right now is: DHCP I get an IP configuration on the clients; I can access the server from the clients and backwards. But I can not ping anything further for example the eth0 of the server or the gateway behind it ... – derHugo Jan 30 '17 at 15:41
  • @Terrance the private network starts with 192.168.x.x – derHugo Jan 30 '17 at 15:41

Thanks for the image, which makes things clearer.

First, as your clients are in network, they need to have a default router in the same subnet (they would not know how to reach another subnet), so the DHCP entry should read option routers - the address of 'My Server' in that subnet.

Now they should send packets for any other network (except from to the address in the hope that would know how to route them.

As 'My Server' has a default route to, it will pass those packets to 'Gateway' if the destination is outside its direct attached networks. And hopefully 'Gateway' will pass them further, using NAT. Up to now it's OK.

When the target host (say tries to respond, it sends the response to 'Gateway'; this one knows that the request came from say But now there is a problem: 'Gateway' does not have a route to, and so again passes the packet to its default route (or drops it maybe, as your private network is not routed at all).

If you have no access to change the configuration of 'Gateway', there are two solutions:

  1. If 'Gateway' listens to any sort of router information protocol on the inside, say RIP2, OSPF or BGP, 'My Server' should announce its routing information on the network. How to do that see e.g. Dynamic Routing or How to Turn....
  2. If this does not work, your only chance is to use NAT on 'My Server' instead of routing. This is done by 'masquerad'ing; it is described in How to Turn... as well.
  • Hi sorry wasn't in the office till today.. Thanks a lot for your detailed answer! Yes I guess since I can ping the "extarnal" NIC from my office PC the problem has to be in the Gateway as you described. So I will first try this Dynamic Routing thing. Is there some form to find out what the Gateway is listening to? Or will I have to try every option and hope? – derHugo Feb 3 '17 at 7:40
  • hm according to your second link about How to Turn... it says for Dynamic Routing: "Important: Don’t forget to repeat the following setup for both routers." ... so since I have no access at the Gateway this means I can not use this method, can I? – derHugo Feb 3 '17 at 8:00
  • Hey thanks to your explanation and the hint with NAT I finally got it! The Clients have Internet via DHCP! Important Question now: Is this setUp via NAT and Masquerading compatible with a Firewall like shorewall? Since it is an office we need a very well configured Firewall and shorewall is the one I'm most used to. I did the iptables SetUp exactly the same as in This question is this a recomendable setup? – derHugo Feb 3 '17 at 8:40
  • As I don't know shorewall, and are not very familiar with iptables, I can't help any further. Maybe ask a new question? – ridgy Feb 3 '17 at 9:41
  • Ok, thanks anyway!! I finally can work with it from now ;) – derHugo Feb 3 '17 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.