I have two computers, each one with two network interfaces, both are ubuntu. I want to implement bellow architecture:

enter image description here

I need to generate traffic from interface eth0: to interface through firewall machine. How to implement this architecture?

by considering usage of iptables linux packet filtering in firewall machine to filter traffic.

another consideration: use of this architecture as a replicator of pcap files (client traffic on one interface and server traffic on another interface through firewall machine )

  • This is an interesting case. May I ask why you would want to route the traffic through the firewall instead to the host's own interface?
    – StockB
    Apr 29 '16 at 18:23
  • 1
    special case : to replay pcap file packets, client traffic on one interface and server traffic on other interface ...
    – kikilinux
    Apr 30 '16 at 5:56
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 7 '17 at 20:22

In this configuration the client machine will have directly connected route in its routing table, for both networks. Those route are of kernel type and will always be preferred over other routes you could set.

So whatever your configuration is, the traffic initiated on this machine destined to will always be considered as local and will never exit trough eth0.

I doubt you could change Ubuntu routing decision on a kernel type route, but who knows?

You may use a software that will generate the traffic sending it trough eth0 irrespectively of the machine routing table

Even if you do so, the answer will not pass trough the firewall, since the answer will be directd to which, once again is a local address.


You can setup on the client machine a virtual machine, and configure the IP address in this VM, then set on the client machine a route to send traffic destined to via

Regarding the pcap replicator I don't get it...

  • I can use the command: ping -I eth0 to send ping traffic via eth0 but it just send the packets on this interface and nothing pass through firewall machine, I can just seen the packet received by firewall machine and not send to interface even to interface ...
    – kikilinux
    Apr 29 '16 at 12:01
  • The "-I eth0" option actually force the ping to leave trough eth0. Is routing on your firewall machine configured correctly ?
    – JFL
    Apr 29 '16 at 12:07
  • When the firewall interface directly connected to each network, is it needed to define route ?!!!
    – kikilinux
    Apr 30 '16 at 5:57
  • No, but is IP routing enabled?
    – JFL
    Apr 30 '16 at 7:54
  • If you mean /proc/sys/net/ipv4/ip_forward, yes it is enable.
    – kikilinux
    Apr 30 '16 at 8:02

One possible soloution is network namespaces (basically the linux equivilent of what router vendors call VRFs).

Each network namespace is logically a seperate instance of the network stack. so if you put the two network interfaces in seperate network namespaces then they will only be able to communicate via the firewall.

If you want to be able to monitor/inject in the main network namespaces then you can leave the physical interfaces in the main network namespace and connect them to secondary network namespaces through bridges and veth devices.


You can use tcpreplay to send out a previously captured trace on a specific interface.

  • Can tcpreplay send out client-server packets separately to different interface? I don't think so.
    – kikilinux
    May 1 '16 at 4:20
  • It should. May 1 '16 at 7:53

I think you can NAT the to a different address on the firewall device and send traffic to that IP address.

eg NAT to

Send traffic to so that the firewall would unnat the IP to the and send it to the client on the other interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.