Differences

This shows you the differences between two versions of the page.

--- networking:ip_forwarding [2025/05/21 08:57] – created peter
+++ networking:ip_forwarding [2025/05/21 09:10] (current) – peter
@@ Line 24: / Line 24: @@
 </code>
-<WRAP center round info 60%>
+<WRAP info>
 **NOTE:**  This shows the net.ipv4.ip_forward kernel setting is 0, which means it is off.
@@ Line 58: / Line 58: @@
 sysctl -w net.ipv4.ip_forward=1
 </code>
+<WRAP important>
+**WARNING:**  This will not make the change persistent.
+</WRAP>
 ----
-Alternatively, change the setting inside **/proc/sys/net/ipv4/ip_forward** to turn the setting on or off.
+==== Alternatively, using proc ====
+Change the setting inside **/proc/sys/net/ipv4/ip_forward** to turn the setting on or off.
 <code bash>
@@ Line 70: / Line 76: @@
 echo 1 > /proc/sys/net/ipv4/ip_forward
 </code>
+<WRAP important>
+**WARNING:**  This will not make the change persistent.
+</WRAP>
+----
+==== Ensure persistency ====
+To make sure the new setting survives a reboot, edit the **/etc/sysctl.conf** file.
+Add one of the following lines to the bottom of the file, depending on whether to have IP forwarding on or off.
+<file bash /etc/sysctl.conf>
+net.ipv4.ip_forward = 0
+or
+net.ipv4.ip_forward = 1
+</file>
+Then, save your changes to this file.
+<WRAP info>
+**NOTE:** The setting will be permanent across reboots.
+</WRAP>
+----
+==== Make the changes take effect right away ====
+<code bash>
+sysctl -p
+</code>
+----
+===== Troubleshooting =====
+Check the status of sysctl with this command:
+<code bash>
+systemctl status sysctl
+</code>
+----
+The service should say that it is active. If not, start the service with this command:
+<code bash>
+sudo systemctl start sysctl
+</code>
+On non-systemd Linux installs, checking the status of sysctl will be different. Try:
+<code bash>
+rc-service sysctl status
+</code>
+----
+If IP forwarding is successfully enabled (verified by checking the kernel variable after reboot), but traffic is still not being received on destination systems, check the FORWARD rules of iptables.
+<code bash>
+iptables -L -v -n
+</code>
+returns:
+<code>
+...
+Chain FORWARD (policy ACCEPT 667 packets, 16724 bytes)
+ pkts bytes target     prot opt in     out     source               destination
+</code>
+<WRAP info>
+**NOTE:**  The FORWARD chain should either be set to ACCEPT, or have rules listed that allow certain connections.
+  * Check if traffic is reaching the FORWARD chain of iptables by checking the amount of packets and bytes that have hit the chain.
+  * If none, then there may be some higher rules in the chain that are blocking traffic.
+</WRAP>
 ----
@@ Line 80: / Line 171: @@
   * TAG:  Routing
   * TAG:  Security
+  * TAG:  Server
+----