Take the 2-minute tour ×

I need to set up routing, preferably with iptables, that does no NAT. Basically I will have a number of clients on subnet and they need their traffic to go through a gateway, say and that gateway then passes on the request, without translating the original address, to another gateway, say What I really want to do is use iptables so I can configure a fine grain firewall to do the routing but all I can find info on is how to do this with NAT. Which I have done before. Any insight on how to do the routing without NAT?

share|improve this question
"assigning us a Class C subnet" -- I'll bet they aren't. –  womble Aug 5 '12 at 0:08
Our institution owns a Class B block of public addresses. They are assigning us a Class C block. Why do you say they are not? –  Erik Weiss Aug 5 '12 at 0:12
If your institution "owns" a class B subnet, they cannot, by the very definition of a classful addressing, assign you a class C subnet out of that block. Cannot be done. That's before we start into the issue of classful addressing being declared obsolete over 20 years ago... –  womble Aug 5 '12 at 0:20
Fair enough, call it what you like, but they are "allocating" us a class C subnet of addresses and I am stumped on how to do the routing with iptables. I will edit my original question to generalize it. –  Erik Weiss Aug 5 '12 at 0:27
They're not allocating you a class C subnet either. Classful addressing is dead. –  womble Aug 5 '12 at 0:38

2 Answers 2

Routing without NAT is just like routing with NAT... only without the NAT. You add routing table entries to indicate next-hop destinations.

Firewalling without NAT is just like firewalling with NAT... only without the NAT. You add firewall rules to permit traffic with certain attributes (source/dest addresses and ports, protocols, state parameters, etc) in like with organisational policy.

share|improve this answer

No need nat here, add your deny/accept rules to FORWARD chain of filter table,

also don't forget to enable forwading on both devices:


or setup it via sysctl (net.ipv4.conf.all.forwading=1 in /etc/sysctl.conf)

share|improve this answer

Your Answer


