I'm running Fedora 10, so your mileage may vary. This is a problem I recently solved and thought that others might benefit from it.

I have a server with two NICs. My eth0 goes to my cable modem and eth1 goes to the internal network. Also, eth0 is the gateway for network.

If the server is freshly booted then the internal network machines can not see the outside world. But the network became visible if the firewall was rebooted. Also, note that the firewall was the same both before and after restart.

The solution terms out to be the following:

In /etc/sysctl.conf, this must be set.

net.ipv4.ip_forward = 1

otherwise NAT won't function. In my case, the firewall was actually setting ip_forward to the correct value, but the network service script was resetting all kernel params based on the content of /etc/sysctl.conf.

So, the old sequence went like this at boot

firewall start # ip_forward turned on
network start # ip_forward turned off
firewall restart # ip_forward turned back on.


Now with the setting properly set in sysctl.conf, the startup works correctly.

It seems like a fairly common newbie mistake to believe that the iptables service script will take care of enabling IP forwarding. As you've found out, that isn't the case. The sysctl.conf suggestion you've made is pretty much the standard way of making sure IP forwarding is enabled. Another option would be to echo into /proc from a startup script (such as rc.local).

Just to be clear, the firewall was setting ip_forward but the networking script which comes after the firewall at boot time was actually re-executing the sysctl.conf file. That re-execution was shutting ip_forward off. I am not using the iptables service at all; I'm using another firewall. Prior to Fedora 10, I had no need to set ip_forward in the conf file.

Thanks for the clarification. They most likely prefer it if people use the actual iptables service, with which you'll need to edit sysctl.conf anyway. But if you didn't see this behavior before then it could be a bug I guess. You could break your script into two sections, one for iptables commands and one for setting kernel parameters (which you'd place further down the startup, like in rc.local, for example). Although, honestly, the cleanest choice IMHO is indeed sysctl.conf.

BTW, why aren't you using the iptables service?

I doubt that there are any theys who would have any preference for how or whether I set up my firewall. There are a number of firewall encapsulations out there for iptables. The one I use is something called fiaif, for Fiaif Is An Intelligent Firewall. It's easy to configure and it gives very fine controls.

LOL! Good point.

You should check in with their mailing list to see what's up.

I mean, if FIAIF is supposed to let you set kernel parameters, and they are getting reset, that's a bug.