{"id":39340,"date":"2026-07-03T03:58:04","date_gmt":"2026-07-03T10:58:04","guid":{"rendered":"https:\/\/www.privateinternetaccess.com\/blog\/?p=39340"},"modified":"2026-07-03T04:05:54","modified_gmt":"2026-07-03T11:05:54","slug":"linux-ip-forwarding","status":"publish","type":"post","link":"https:\/\/www.privateinternetaccess.com\/blog\/linux-ip-forwarding\/","title":{"rendered":"Linux IP Forwarding: Complete Setup Guide"},"content":{"rendered":"\n

Linux IP forwarding is essential for many advanced networking tasks<\/strong>, but enabling it without the right configuration can create unintended security and connectivity issues. Whether you\u2019re setting up a router, gateway, VPN, or another network service in Linux, it\u2019s important to know when to enable IP forwarding, how to configure it, and when to disable it.<\/p>\n\n\n\n

This guide shows you how to check whether Linux IP forwarding is on and how to enable it temporarily or permanently. You\u2019ll also learn how to troubleshoot common issues and turn it off when you\u2019re done.<\/p>\n\n\n\n

\n

Table of Contents<\/h4>\nWhat Is IP Forwarding in Linux?<\/a>
\nHow to Enable IP Forwarding on Linux<\/a>
\nHow to Disable IP Forwarding on Linux<\/a>
\nTroubleshooting Linux IP Forwarding<\/a>
\nWhen Should You Use IP Forwarding on Linux?<\/a>
\nLinux IP Forwarding Risks<\/a>
\nFAQ<\/a>
<\/div>\n\n\n\n\n

<\/p>\n\n\n

What Is IP Forwarding in Linux?<\/h2>\n\n\n\n

Linux IP forwarding is a kernel-level feature<\/strong>1<\/sup><\/strong> that lets the system forward IP packets between network interfaces<\/strong>, essentially turning your Linux machine into a router. It\u2019s turned off by default, so a Linux machine only handles packets meant for its own IP address and drops any packets addressed to a different interface. When you enable it, the system checks the destination IP against its routing table and forwards each packet to the right network interface.<\/p><\/div>\n\n\n\n

How to Enable IP Forwarding on Linux<\/h2>\n\n\n\n

The steps below show how to check whether you\u2019ve enabled IP forwarding and how to turn it on. You have two ways to do this. A temporary change applies right away but resets after a reboot, while a permanent change survives restarts.<\/p>\n\n\n\n

Check If IP Forwarding Is Enabled<\/h3>\n\n\n\n

First, check whether IP forwarding is already on:<\/p>\n\n\n\n

    \n
  1. Open the Terminal (press Ctrl+Alt+T).<\/em><\/li>\n<\/ol>\n\n\n\n
      \n
    1. To check whether IPv4 forwarding is set up, run echo 1 | sudo tee \/proc\/sys\/net\/ipv4\/ip_forward and press Enter<\/em>.\u00a0<\/li>\n<\/ol>\n\n\n\n
        \n
      1. For IPv6, type echo 1 | sudo tee \/proc\/sys\/net\/ipv6\/conf\/all\/forwarding<\/code> and press Enter.<\/em><\/li>\n<\/ol>\n\n\n\n
        \"Screenshot<\/figure>\n\n\n\n

        In both cases, a value of 1 in the command output means that IP forwarding is on, and 0 means it\u2019s disabled.<\/p>\n\n\n\n

        Enable IP Forwarding Temporarily<\/h3>\n\n\n\n
          \n
        1. Open the Terminal.<\/em><\/li>\n<\/ol>\n\n\n\n
            \n
          1. For IPv4, type sudo sysctl -w net.ipv4.ip_forward=1, <\/strong>press Enter,<\/em> and enter your password if prompted. (Don\u2019t worry if nothing appears on the screen when you\u2019re typing your password \u2013 this is to stop anyone from reading your password over your shoulder.)<\/li>\n<\/ol>\n\n\n\n
              \n
            1. For IPv6, type sudo sysctl -w net.ipv6.conf.all.forwarding=1<\/code>, press Enter,<\/em> and enter your password if prompted.<\/li>\n<\/ol>\n\n\n\n

              On setups without systemd or sysctl, you can enable forwarding through the kernel command line instead. Add net.ipv4.ip_forward=1<\/code> and net.ipv6.conf.all.forwarding=1<\/code> to \/etc\/default\/grub<\/code>, then rebuild the bootloader with sudo update-grub<\/code>.<\/p>\n\n\n\n

              To confirm it worked, run the check command from above and make sure the values now show 1.\u00a0<\/p>\n\n\n\n

              Enable IP Forwarding Permanently<\/h3>\n\n\n\n
                \n
              1. Open the Terminal, run sudo nano \/etc\/sysctl.conf<\/code>, and enter your password if prompted.<\/li>\n<\/ol>\n\n\n\n
                  \n
                1. Scroll through the sysctl.conf <\/em>file and find the net.ipv4.ip_forward = 1<\/code> and net.ipv6.conf.all.forwarding = 1<\/code> lines.<\/li>\n<\/ol>\n\n\n\n
                  \"Screenshot<\/figure>\n\n\n\n
                    \n
                  1. Uncomment net.ipv4.ip_forward = 1<\/code> to enable IPv4 forwarding and net.ipv6.conf.all.forwarding = 1 <\/code> to enable IPv6 forwarding. You can do so by removing the #<\/em><\/strong> sign at the start of each line.<\/li>\n<\/ol>\n\n\n\n
                    \"Screenshot<\/figure>\n\n\n\n
                      \n
                    1. Press Ctrl + O<\/em> <\/strong>to write to the file, then press Enter<\/em> <\/strong>when you see the File name to write: \/etc\/sysctl.conf <\/strong>prompt.<\/li>\n<\/ol>\n\n\n\n
                      \"Screenshot<\/figure>\n\n\n\n
                        \n
                      1. Press Ctrl + X<\/em> <\/strong>to return to the terminal once you see a Wrote [X] lines <\/strong>prompt.<\/li>\n<\/ol>\n\n\n\n
                        \"Screenshot<\/figure>\n\n\n\n
                          \n
                        1. Run sudo sysctl -p<\/code> to apply the changes.\u00a0<\/li>\n<\/ol>\n\n\n\n
                          \"Screenshot<\/figure>\n\n\n\n

                          How to Disable IP Forwarding on Linux<\/h2>\n\n\n\n

                          Disabling Linux IP forwarding follows the same process as enabling it, just with the values reversed<\/strong>. If you enabled it temporarily, set the value to 0 in the sysctl -w command. If you enabled it permanently, comment out the net.ipv4.ip_forward = 1<\/code> and net.ipv6.conf.all.forwarding = 1<\/code> lines in the sysctl.conf <\/strong>file by adding #<\/em> to the start of each line.<\/p>\n\n\n\n

                          Troubleshooting Linux IP Forwarding<\/h2>\n\n\n\n

                          Most Linux IP forwarding problems come down to settings that don\u2019t survive a reboot, traffic that won\u2019t route even though you enabled forwarding, or a sysctl service that isn\u2019t running. The steps below help you diagnose and fix each one.<\/p>\n\n\n\n

                          Change Not Persisting After Reboot<\/h3>\n\n\n\n

                          If you have to re-enable Linux IP forwarding after every reboot, you\u2019re probably setting it temporarily with the sysctl -w<\/code> command, which only lasts until the next restart. Follow the steps to permanently enable IP forwarding<\/a> to resolve the problem. It writes the setting into the sysctl.conf file, and the system reads that file on every boot, so the change sticks.<\/p>\n\n\n\n

                          Traffic Still Not Forwarding Despite Enabling the Setting<\/h3>\n\n\n\n

                          If you enabled IP forwarding but traffic still isn\u2019t routing, the problem could be the FORWARD chain in iptables, which filters packets that don\u2019t originate from the host machine and aren\u2019t addressed to it. These steps will help:<\/p>\n\n\n\n

                            \n
                          1. Open the Terminal, run sudo iptables -L FORWARD -v -n<\/code>, and enter your password if prompted. This shows the FORWARD chain policy.<\/li>\n<\/ol>\n\n\n\n
                              \n
                            1. Check the policy. If it\u2019s set to DROP and no rules allow your forwarded traffic, the FORWARD chain is blocking it, so continue with the steps below. If it says ACCEPT, the FORWARD chain isn\u2019t the cause and the problem likely lies elsewhere. Check that you\u2019ve applied the forward settings or if another firewall rule is blocking the traffic.<\/li>\n<\/ol>\n\n\n\n
                              \"Screenshot<\/figure>\n\n\n\n
                                \n
                              1. Run ip a<\/code> to find the names of the two interfaces you want to forward between. Then add rules allowing forwarding in that direction, with return traffic limited to established connections. Replace eth1<\/code> and eth0<\/code> in the commands below with your own interface names:
                                sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT<\/code>
                                sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT<\/code>.\u00a0<\/li>\n<\/ol>\n\n\n\n
                                  \n
                                1. Run sudo iptables -L FORWARD -v -n<\/code> again <\/strong>to confirm your new rules now appear in the FORWARD chain. The default policy will still show DROP. The rules you added are what permit your specific traffic.<\/li>\n<\/ol>\n\n\n\n
                                  \"Screenshot<\/figure>\n\n\n\n

                                  Adding rules for only the interfaces you need is safer than setting the whole FORWARD policy to ACCEPT, which would let all forwarded traffic through. That\u2019s worth avoiding on a production or internet-facing machine.<\/p>\n\n\n\n

                                  Sysctl Service Not Running<\/h3>\n\n\n\n

                                  If neither of the steps above works, Linux may not be applying your settings. These steps will reapply them.<\/p>\n\n\n\n

                                    \n
                                  1. Open the Terminal.<\/em><\/li>\n<\/ol>\n\n\n\n
                                      \n
                                    1. Run sudo sysctl --system<\/code> and enter your password if prompted. This reloads your saved sysctl values from their config files without a reboot.<\/li>\n<\/ol>\n\n\n\n
                                        \n
                                      1. Confirm forwarding is now on by running cat \/proc\/sys\/net\/ipv4\/ip_forward<\/code>. A value of 1 means it\u2019s enabled, and 0 means it\u2019s still off.<\/li>\n\n\n\n
                                      2. If your system doesn\u2019t use systemd or sysctl (e.g., WSL), set the value with echo 1 | sudo tee \/proc\/sys\/net\/ipv4\/ip_forward<\/code>.<\/li>\n<\/ol>\n\n\n\n

                                        When Should You Use IP Forwarding on Linux?<\/h2>\n\n\n\n

                                        You\u2019ll use Linux IP forwarding whenever your machine needs to pass traffic between two or more networks on behalf of other devices.<\/strong> Here are the main cases.\u00a0<\/p>\n\n\n\n

                                        VPN Servers<\/h3>\n\n\n\n

                                        Running a VPN server requires IP forwarding. The server receives encrypted packets on the VPN tunnel interface and forwards them to the destination network through another interface. Without forwarding, the server drops those packets as they arrive.<\/p>\n\n\n\n

                                        There\u2019s an important difference between running a server and using a VPN as a client. If you\u2019re connecting to a VPN on your Linux device<\/a> with a client app like PIA, you don\u2019t need IP forwarding, since your machine isn\u2019t routing traffic for anyone else. It\u2019s also worth noting that IP forwarding and VPN port forwarding<\/a> aren\u2019t the same thing. They sound similar but do different jobs.<\/p>\n\n\n\n

                                        Router or Network Gateway<\/h3>\n\n\n\n

                                        If your Linux machine sits between multiple networks and passes traffic between them, it\u2019s effectively acting as a router. It needs IP forwarding enabled so it routes those packets instead of dropping them on arrival.<\/p>\n\n\n\n

                                        Container Networking<\/h3>\n\n\n\n

                                        Containerization uses platforms like Docker to package an application with everything it needs to run. Containers sometimes need to communicate with one another, and they do that over a bridge network, which relies on IP forwarding to work2<\/sup>.<\/p>\n\n\n\n

                                        NAT and Internet Sharing<\/h3>\n\n\n\n

                                        To let several devices on a private network share one internet connection, your Linux system uses IP forwarding to act as a network address translation (NAT) device. It translates the private addresses to a single public-facing IP and forwards the packets accordingly.<\/p>\n\n\n\n

                                        Linux IP Forwarding Risks<\/h2>\n\n\n\n

                                        Linux IP forwarding expands what your system can do on the network, but it also creates exposure if you don\u2019t manage it carefully. The main risks include:<\/p>\n\n\n\n