Routing multiple networks with iptables

Posted on 2003-03-09
Medium Priority
Last Modified: 2010-03-18
I have my Intranet web ( server on a 192.168.10.x network. I have a Linux router setup with 2 NIC's and IPTABLES with addresses eth0 and eth1 I have the router setup where any PC on the 192.168.20.x network can browse to and access my web browser.

My question is....How do I setup another IPTABLES Linux router so that I can connect a third LAN (192.168.30.x) to have access to my web server by routing into the 192.168.20.x LAN? For example, I would setup a Linux router box with 2 NIC's with eth0 and eth1 I want users on the 192.168.30.x LAN to browse to and get access to my web browser. Any ideas?
Question by:nayen99
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions

Expert Comment

ID: 8099141
Exactly the same way the first router was setup, but you forward to instead of forwarding to Or am I misunderstanding the question ?

Expert Comment

ID: 8099717
One way is to add another rule to your first router that allows 192.168.30.x to browse, and add a rule to router2 to do DNAT on the incoming web requests to forward them on to your web server.

On router1, add:
iptable -t filter -A FORWARD -s -d -j ACCEPT

and on router2, add:
iptables -t nat -A PREROUTING -s -p tcp --dport 80 -j DNAT --to-destination

Then clients on 192.168.30.x can browse to and be silently redirected to

Accepted Solution

Kocil earned 225 total points
ID: 8100549
> How do I setup another IPTABLES Linux router so that
> I can connect a third LAN (192.168.30.x) to have access
> to my web server by routing into the 192.168.20.x LAN?
Why do you need to route it through 20.x LAN ?
I think it is easier and faster if you just add another NIC on your first router (eth2), give it IP, and connect it to  the 30.x network.

Then you add the same IP tables rules
iptables -t nat -A PREROUTING -s -p tcp --dport 80 -j DNAT --to-destination
iptable -A FORWARD -s -d -j ACCEPT


Expert Comment

ID: 8100565
Oops ... correction for rules
Then you add the same IP tables rules
iptables -t nat -A PREROUTING -s -d -p tcp --dport 80 -j DNAT --to-destination
iptable -A FORWARD -s -d -j ACCEPT

Author Comment

ID: 8110944
I thought about this problem constantly for the last few days and that is the same solution I came up with. You just confirmed it. I simply need to add another NIC to the first router and use the same basic IPTABLES rules to route into the third network. Thanks.

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I have seen several blogs and forum entries elsewhere state that because NTFS volumes do not support linux ownership or permissions, they cannot be used for anonymous ftp upload through the vsftpd program.   IT can be done and here's how to get i…
Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
This tutorial will teach you the special effect of super speed similar to the fictional character Wally West aka "The Flash" After Shake : http://www.videocopilot.net/presets/after_shake/ All lightning effects with instructions : http://www.mediaf…
Suggested Courses

765 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question