Table of Contents

Networking - IP Forwarding

IP forwarding is also known as routing.

If the Linux server is acting as a firewall, router, or NAT device, it will need to be capable of forwarding packets that are meant for other destinations (other than itself).

Linux uses the net.ipv4.ip_forward kernel variable to toggle this setting on or off.

Check if IP forwarding is enabled or disabled, using sysctl

sysctl net.ipv4.ip_forward

returns: 

net.ipv4.ip_forward = 0

NOTE: This shows the net.ipv4.ip_forward kernel setting is 0, which means it is off.

  • If it were set to 1, that would mean it is enabled.

Alternatively, check if IP forwarding is enabled or disabled, using proc

cat /proc/sys/net/ipv4/ip_forward

returns: 

0

Enable or disable IP forwarding

Using sysctl

sysctl -w net.ipv4.ip_forward=0
 
or
 
sysctl -w net.ipv4.ip_forward=1

WARNING: This will not make the change persistent.

Alternatively, using proc

Change the setting inside /proc/sys/net/ipv4/ip_forward to turn the setting on or off. 

echo 0 > /proc/sys/net/ipv4/ip_forward
 
or
 
echo 1 > /proc/sys/net/ipv4/ip_forward

WARNING: This will not make the change persistent.

Ensure persistency

To make sure the new setting survives a reboot, edit the /etc/sysctl.conf file.

Add one of the following lines to the bottom of the file, depending on whether to have IP forwarding on or off.

/etc/sysctl.conf
net.ipv4.ip_forward = 0
 
or 
 
net.ipv4.ip_forward = 1

Then, save your changes to this file.

NOTE: The setting will be permanent across reboots.

Make the changes take effect right away

sysctl -p

Troubleshooting

Check the status of sysctl with this command: 

systemctl status sysctl

The service should say that it is active. If not, start the service with this command: 

sudo systemctl start sysctl

On non-systemd Linux installs, checking the status of sysctl will be different. Try: 

rc-service sysctl status

If IP forwarding is successfully enabled (verified by checking the kernel variable after reboot), but traffic is still not being received on destination systems, check the FORWARD rules of iptables. 

iptables -L -v -n

returns: 

...       
Chain FORWARD (policy ACCEPT 667 packets, 16724 bytes)
 pkts bytes target     prot opt in     out     source               destination

NOTE: The FORWARD chain should either be set to ACCEPT, or have rules listed that allow certain connections.

  • Check if traffic is reaching the FORWARD chain of iptables by checking the amount of packets and bytes that have hit the chain.
  • If none, then there may be some higher rules in the chain that are blocking traffic.

TAGS