- one Linux box with multiple Ethernet interfaces
- at least two networks with segments assigned
- a desire to make the Linux box route packets between the networks
A quick little blog post with info obtained by pestering my more knowledgeable colleagues.
Although the Linux kernel is capable of routing packets, by default it is not configured to do so. There are two dimensions to accomplishing this:
- telling the kernel to forward packets (IPv4, IPv6)
- telling the operating system to tell the kernel to forward packets
The second step is necessary because, without it, the kernel will revert to its default "non-routing" behavior at the next boot.
Tell the kernel to route packets
There are lots of HOWTOs on this. For example, Marius Ducea has a nice one.
There is more to it than just one sysctl parameter, though. On my router I am setting all of these:
net.ipv4.ip_forward = 1 net.ipv4.conf.default.forwarding = 1 net.ipv4.conf.all.forwarding = 1 net.ipv6.conf.default.forwarding = 1 net.ipv6.conf.all.forwarding = 1
Make the settings survive reboot
On SUSE there are several factors that must be taken into account. First of all, there is
/etc/sysctl.conf, where I have the above lines. This just by itself is not enough, however, because there is another crucial file . . .
The other file is
/etc/sysconfig/sysctl, where I set the following parameters:
IP_FORWARD="yes" IPV6_DISABLE="no" IPV6_FORWARD="yes"
If, for example, the
IP_FORWARDparameter is set to "no", the settings in
/etc/sysctl.confwill effectively be ignored, because
For completeness, there is also
/etc/sysconfig/network/ifsysctlfor interface-specific sysctl settings. See
man ifsysctlfor details.
Many sources write about using
iptablesto route packets. This may have been necessary in the olden days, but ever since the advent of iproute2, it is not necessary or even desirable to use
iptables(i.e. the userspace interface to
netfilter) for static routing.
iptablesis for filtering packets, while
iproute2is for routing packets.
ipcommand is still a bit new, so it's good to remind myself that it replaces older commands, like
brctl, that are now deprecated (though still present in all major Linux distributions for backward compatibility) and have been obsoleted by iproute2.