Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To turn a CentOS 7 machine into an IPv4 gateway, enable kernel forwarding, make that setting persistent, permit the intended traffic through the firewall, and add a NAT masquerade rule on the external interface. A typical iptables configuration is:
sysctl -w net.ipv4.ip_forward=1
printf 'net.ipv4.ip_forward = 1n' >> /etc/sysctl.conf
sysctl -p /etc/sysctl.conf
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEReplace eth0 and eth1 with the host’s real external and internal interfaces. Forwarding and masquerading are separate controls: the first routes packets between interfaces, while the second rewrites private source addresses as packets leave for an external network.
What you are configuring
A gateway has at least two network paths: an internal interface connected to a private LAN and an outward-facing interface connected to another network. Clients on the private side use the CentOS host as their router. The Linux kernel must forward packets between interfaces, and the firewall must allow that forwarding. Because private addresses are not normally routable on the public side, network address translation (NAT) changes the source address of outbound packets to the gateway’s address.
CentOS 7 is an end-of-life platform. These commands are therefore legacy-platform guidance. Apply them only where CentOS 7 remains necessary, document the change, and plan migration to a maintained distribution.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Prerequisites and topology checks
Work as root or use sudo
Changing sysctl values and firewall rules requires root privileges. Start a root shell or prefix each command with sudo. Keep an existing console or out-of-band session available so a mistaken firewall rule does not lock you out.
Identify the real interfaces
The names eth0 and eth1 are examples, not guaranteed CentOS 7 names. Discover the addresses and routes before writing rules:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →ip addr
ip routeThe interface carrying the default route is normally the external interface. The interface with the private client subnet is the internal interface. A gateway can have more than one internal interface; each one needs a policy appropriate to its own subnet.
Record the intended traffic policy
- External interface used for NAT.
- Internal interface or interfaces whose clients may use the gateway.
- Private source subnet(s) that should be translated.
- Whether forwarding should be broad or restricted to particular destinations and connection states.
Do not copy an example rule unchanged if its interface direction does not match your topology.
Enable IPv4 forwarding immediately
The kernel variable net.ipv4.ip_forward is a Boolean switch. A value of 0 disables forwarding between interfaces; 1 enables it. Its documented default is 0.
- Run the immediate change as root:
sysctl -w net.ipv4.ip_forward=1 - Confirm the running value:
sysctl net.ipv4.ip_forward cat /proc/sys/net/ipv4/ip_forward
Both checks should report net.ipv4.ip_forward = 1 or a plain 1, respectively. This change affects the running kernel only; it does not survive a reboot until you persist it.
Important ordering detail
Linux kernel documentation notes that changing ip_forward resets IPv4 configuration parameters to host or router defaults. Set forwarding before applying dependent IPv4 tuning so that later parameter changes are not discarded by the forwarding switch.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Make forwarding persistent across reboots
Use /etc/sysctl.conf
Add one setting to the system configuration file:
net.ipv4.ip_forward = 1Edit the file with your preferred editor, or append the line carefully if it is not already present. Avoid leaving contradictory active entries that set the value back to 0.
Load and verify the file now
Reload the file without rebooting:
sysctl -p /etc/sysctl.confsysctl -p is equivalent when the default file is /etc/sysctl.conf. The reload output should show the configured forwarding value. Check again with:
sysctl net.ipv4.ip_forwardIf the result remains 0, inspect the file for a duplicate setting, a spelling error, or a later configuration file that overrides it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Alternative drop-in location
Some administrators keep local kernel settings in a file under /etc/sysctl.d/ rather than editing the main file. That approach is also persistent, provided the system’s sysctl loading process reads the drop-in. Whichever location you choose, keep one authoritative setting and verify the effective value after loading it.
Permit forwarding in an iptables firewall
Enabling the kernel switch does not override firewall policy. The FORWARD chain still decides whether packets traversing the host are accepted.
Basic interface-based example
Red Hat’s example accepts traffic arriving on the internal interface and traffic leaving through it:
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -o eth1 -j ACCEPTReplace eth1 with the actual internal interface. These rules are intentionally broad. They may allow more traffic than your security policy requires, especially on a multi-interface host.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Narrow the policy when possible
A production gateway should limit forwarding to the intended topology. Useful match dimensions include:
- Inbound and outbound interface, using
-iand-o. - Source subnet, such as the private LAN range.
- Destination network or service.
- Connection state, so replies to established connections are handled without opening unrelated traffic.
For example, a rule can be restricted to packets arriving from the known private interface and subnet rather than every packet that enters that interface. The exact subnet and state policy depend on your network design; do not substitute an example address range for the one actually assigned to your LAN.
Check rule order and counters
iptables evaluates rules in chain order. An earlier DROP or REJECT can prevent a later ACCEPT from matching. After generating test traffic, inspect the active rules and packet counters with:
iptables -L FORWARD -n -vA counter that stays at zero indicates that the rule is not matching the test packets, the traffic is using another interface, or an earlier rule handles it first.
Add masquerading on the external interface
Masquerading belongs in the NAT table’s POSTROUTING chain:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEReplace eth0 with the interface through which packets leave toward the outside network. The rule rewrites private client source addresses to the gateway’s external address as packets leave that interface, allowing replies to return through the gateway.
Understand each part of the rule
| Element | Purpose |
|---|---|
-t nat |
Selects the NAT table. |
-A POSTROUTING |
Appends the rule to the postrouting chain, after routing has selected the outgoing path. |
-o eth0 |
Matches packets leaving the specified external interface. |
-j MASQUERADE |
Rewrites the private source address to the gateway’s external address. |
Masquerading does not itself permit forwarding. The kernel switch, the FORWARD chain policy, and the NAT rule all have to be correct.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Limit NAT to the intended source network
If the host routes several networks, an interface-only rule can translate traffic that should not be translated. Add a source-subnet match when your policy requires it, using the actual private CIDR assigned to the clients. Keep the external-interface match so unrelated outbound paths are not changed.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Choose one firewall manager
CentOS 7 systems may be administered with direct iptables rules or with firewalld. Determine which service is active before making changes. Do not maintain the same policy independently in both tools: competing managers can overwrite rules or leave the running configuration different from the one you expect.
Direct iptables administration
Use the iptables commands shown above when direct rule management is the established practice on the host. Persist the firewall configuration using the method already approved for that server, and verify the loaded rules after a restart. The sysctl setting is persisted separately in /etc/sysctl.conf or a sysctl drop-in.
firewalld administration
A firewalld-managed host needs zone-aware configuration rather than an independent set of direct iptables commands. The Red Hat workflow is:
- Create a sysctl drop-in containing
net.ipv4.ip_forward = 1. - Reload sysctl settings and confirm the effective value.
- Assign the internal and external interfaces to the zones that represent their trust levels.
- Enable masquerading on the external zone.
- Reload firewalld and verify the active zones, interfaces, and masquerading state.
Use the interface names and zone assignments defined by your site’s policy. A zone assignment is not merely a label: it determines which services and forwarding behavior firewalld applies to that interface.
Verify the complete path
Verification should cover the kernel, firewall, NAT, and an end-to-end client test.
1. Verify the kernel switch
sysctl net.ipv4.ip_forward
cat /proc/sys/net/ipv4/ip_forwardBoth commands should show forwarding enabled.
2. Verify forwarding rules
iptables -L FORWARD -n -vConfirm that the expected interfaces appear, the policy is not blocked by an earlier rule, and counters increase while a permitted client generates traffic.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
3. Verify NAT rules
iptables -t nat -L POSTROUTING -n -vThe masquerade rule should reference the real external interface. Its packet and byte counters should rise when a private client makes an outbound connection.
4. Test from a permitted client
From a client on the internal subnet, test the intended external destination. If the client cannot connect, first confirm that its default gateway points to the CentOS host and that the client has usable DNS or a known test address. Then correlate the test time with the FORWARD and POSTROUTING counters.
5. Check both directions
An outbound request can appear to work while return traffic is blocked by an overly restrictive policy. Test a new connection and a response-bearing protocol, then inspect counters again. A successful counter increment in POSTROUTING confirms that translation matched; it does not by itself prove that the return path is allowed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshooting by symptom
ip_forward reports zero
- Run
sysctl -w net.ipv4.ip_forward=1to restore the running value. - Check that the persistent file contains exactly an enabled setting.
- Run
sysctl -p /etc/sysctl.confand inspect its output. - Look for a later or duplicate setting that overrides the intended value.
Forwarding is enabled but clients still have no connectivity
- Confirm that the client uses the CentOS host as its default gateway.
- Check that the FORWARD chain accepts the traffic direction and that an earlier rule is not dropping it.
- Confirm that the rules use the real interface names, not the illustrative
eth0/eth1names. - Inspect FORWARD counters while reproducing the failure.
FORWARD counters rise but replies do not return
- Inspect the POSTROUTING NAT chain and confirm that MASQUERADE matches the external interface.
- Ensure the source subnet is included if the NAT rule is restricted.
- Check the external route selected by the gateway.
- Review the firewall policy for reply traffic and established connections.
NAT counters remain at zero
- The client traffic may not be leaving through the interface named in
-o. - The packet may be rejected before reaching POSTROUTING.
- The test may originate from a source network excluded by a narrowed rule.
- Another firewall manager may have replaced the direct iptables rule.
Rules disappear after reboot or service reload
Forwarding persistence and firewall-rule persistence are separate. A value in /etc/sysctl.conf does not save iptables rules, and an iptables rule does not create the sysctl setting. Use the persistence mechanism selected for the active firewall manager, then verify the loaded configuration after the event that previously removed it.
Implementation choices at a glance
| Decision | Option | Trade-off |
|---|---|---|
| Forwarding lifetime | sysctl -w only |
Immediate but lost at reboot. |
| Forwarding lifetime | /etc/sysctl.conf or /etc/sysctl.d/ |
Persistent; must be loaded and checked. |
| Firewall manager | Direct iptables | Exact rule control; persistence and ordering are your responsibility. |
| Firewall manager | firewalld zones | Zone-based administration; interface assignment and masquerading must be configured through the active service. |
| Forwarding scope | Broad interface accepts | Simple, but may carry more traffic than intended. |
| Forwarding scope | Interface, subnet, destination, and state restrictions | More work, but better aligned with least-privilege policy. |
| NAT scope | External-interface match | Translates all matching outbound traffic on that interface. |
| NAT scope | External interface plus source subnet | Prevents unrelated routed networks from being translated. |
Operational and security cautions
- Changing forwarding alters the machine from an endpoint-only host into a router for the permitted paths.
- Masquerading hides private client addresses externally; retain internal logging and asset records if you need to attribute connections to individual clients.
- Broad
FORWARDaccepts can unintentionally connect networks that were meant to remain isolated. - Always use the actual external interface in the NAT rule; a syntactically valid rule on the wrong interface has no useful effect.
- Test from a client that is explicitly permitted by the policy, and inspect rule counters rather than relying only on the gateway’s local connectivity.
- Apply changes under your normal change-control process, with a rollback plan for both sysctl and firewall configuration.
Minimal command sequence for a simple two-interface gateway
For a host whose internal interface is eth1 and external interface is eth0, the complete basic sequence is:
- Enable forwarding now:
sysctl -w net.ipv4.ip_forward=1 - Add
net.ipv4.ip_forward = 1to/etc/sysctl.conf. - Load the persistent setting:
sysctl -p /etc/sysctl.conf - Permit the intended forwarded traffic:
iptables -A FORWARD -i eth1 -j ACCEPT iptables -A FORWARD -o eth1 -j ACCEPT - Masquerade packets leaving externally:
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE - Verify the sysctl value, the FORWARD chain, the POSTROUTING chain, and a real client connection.
This sequence is a starting point, not a substitute for matching the rules to your interfaces, subnets, firewall manager, and security policy.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
