I've stumbled upon a rather specific problem and I do not have the knowledge to solve it on my own. I've set up a Ubuntu server (16.04.2) which will act as a router. Until now I've configured two network interfaces, WAN and LAN. Dns works as well, the client gets the local ip address but no access to the internet, perhaps due to wrongly configurated firewall rules. Note: port forwarding is also enabled in .


enp0s3    Link encap:Ethernet  
          inet addr:  Bcast:  Mask:
          RX packets:28 errors:0 dropped:0 overruns:0 frame:0
          TX packets:36 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 

enp0s8    Link encap:Ethernet
          inet addr:  Bcast:  Mask:
          RX packets:2190 errors:0 dropped:0 overruns:0 frame:0
          TX packets:41 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 


auto enp0s3
iface enp0s3 inet dhcp

auto enp0s8
iface enp0s8 inet static


Destination     Gateway         Genmask         Flags Metric Ref    Use 
Iface         UG    0      0        0 enp0s3   U     0      0        0 enp0s3   U     0      0        0 enp0s8

Iptables -L -v& Iptables -t nat -L -v

Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out    source   destination
    0     0 ACCEPT     all  --  lo     any    anywhere anywhere
    3   704 ACCEPT     all  --  enp0s8 any    anywhere anywhere
   12   997 ACCEPT     all  --  enp0s3 any    anywhere anywhere    ctstate RELATED,ESTABLISHED

Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out    source   destination
    0   0   ACCEPT     all  --  enp0s8 enp0s3 anywhere anywhere
    0   0   ACCEPT     all  --  enp0s3 enp0s8 anywhere anywhere     ctstate RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT 12 packets, 904 bytes)
 pkts bytes target     prot opt in     out    source   destination

Chain POSTROUTING (policy ACCEPT 1 packets, 48 bytes)
 pkts bytes target     prot opt in     out    source   destination
    7   520 MASQUERADE  all --  any    enp0s3 anywhere anywhere


I use a rc.local file to use these lines after boot.

iptables -P INPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i enp0s8 -j ACCEPT

iptables -A INPUT -i enp0s3 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i enp0s8 -o enp0s3 -j ACCEPT
iptables -A FORWARD -i enp0s3 -o enp0s8 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE

Client ifconfig

enp0s3    flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
          inet netmask broadcast
          RX packets 8
          RX errors 0 dropped 0 overruns 0 frame 0
          TX packets 221
          TX errors 0 dropped 0 overrunes 0 carrier 0 collisions 0

Can someone please care to explain to me what I am missing? Had to type all the over from a couple of terminals so errors might be there. I shall continue to make corrections if it is necessary.

Thanks in regard!

  • Try adding a dns server into the interfaces file. Likely that's the issue – Sergiy Kolodyazhnyy Jun 12 '17 at 23:00
  • have you tried sudo dhclient ? – Sadegh Alirezaie Jun 12 '17 at 23:46
  • Have you allowed IP forwarding in /etc/sysctl.conf ? Also in your ifconfig says your enp8s0 has IP but in the interface file you give it In your Rc.local you have a zero instead of an o in the last masquerade line – derHugo Jun 13 '17 at 5:21
  • @derHugo changed the zero to an o, thanks. Luckily it was just a type since the code was accepted by terminal before. – Jens Kuipers Jun 13 '17 at 13:51
  • @derHugo In the introduction to the problem I stated that the IP forwarding is enabled. I changed the enp0s8 to the correct values, must have forgotten to change the values from my used ifconfig format since I couldn't copy-paste. – Jens Kuipers Jun 13 '17 at 13:53

You seem to have a number of typos. Or, if they are not typos then they are mistakes in your configuration that would partially explain why things aren't working correctly for you. To obtain meaningful help it would be much better if you copied and pasted the file content or command results rather than trying to just type it all out in your question.

I think your basic problem is that you are not configuring the machine correctly to operate as a router. To function as a two NIC "router" the default gateway for all traffic on your LAN needs to go to the WAN IP which seems to be enp0s3 in your case.

Also note that 10.x.x.x (and IP addresses are, by definition, unroutable. I would expect that the Internet facing subnet of a router would have a registered ip address unless it's traffic is on a subnet where all traffic goes into another modem or router.

Assuming that the mistakes I'm seeing in what you posted are indeed typos and not configuration mistakes, what you have built seems to be more of a bridge / packet forwarder than a router. The WAN you configured looks more like another LAN subnet so I'm not surprised traffic isn't getting to the Internet.

Since you haven't installed any router software and since routers typically have at least three interfaces on them (not including the DMZ), you would be controlling all routing in your configuration through the routing table. You would add routes with the command

route add

Simple enough to use and if you make a mistake you can remove a route with the command

route del 

The man page for this command is relatively self-explanatory. Without knowing how your computer is actually connected to the Internet I can't provide an example of a configuration that would work.

This is an over-simplification but basically, enp0s3 would be a class C IP address that is reachable from the Internet. enp0s8 would be a subnet of your own invention (e.g where the IP address assigned to enp0s3 is the default gateway.

Your routing table can be verified by typing

route -n
  • As I noted earlier, I can't give a direct copy-paste of information since I am running a server edition, no GUI and no possiblity to select and copy-paste. I copy-pasted the format of the ifconfig plus the other code segments and replaced the numbers. Unfortunately I forgot to replace the values at enp0s8 (which have been modified now). As for the class C IPaddress, thanks for the tip, didn't know that. But I am running in a virtual machine, these changes can be made later on since this is a brief introduction for myself to the subject of routers, the real thing will be an exam trainneeship. – Jens Kuipers Jun 13 '17 at 11:10
  • I shall look into the route command, can you perhaps look into it once again since I modified it? – Jens Kuipers Jun 13 '17 at 11:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.