Editing Linux router with WAN, LAN and DMZ (section)

== Enable IP forwarding ==
Without this the kernel drops anything not addressed to itself, and no amount of
firewall rules will make traffic cross between interfaces.

Immediately, until reboot:
<syntaxhighlight lang="bash">
sysctl -w net.ipv4.ip_forward=1
</syntaxhighlight>

Permanently:
<syntaxhighlight lang="bash">
cat >/etc/sysctl.d/99-router.conf <<'EOF'
net.ipv4.ip_forward = 1
# Uncomment if the router also routes IPv6:
# net.ipv6.conf.all.forwarding = 1
EOF

sysctl --system
</syntaxhighlight>

Check the value in force:
<syntaxhighlight lang="bash">
sysctl net.ipv4.ip_forward
cat /proc/sys/net/ipv4/ip_forward
</syntaxhighlight>

=== Disable it again ===
<syntaxhighlight lang="bash">
sysctl -w net.ipv4.ip_forward=0
</syntaxhighlight>

To make that stick, set the value to <code>0</code> in
<code>/etc/sysctl.d/99-router.conf</code> and run <code>sysctl --system</code>
— deleting the file only reverts to the kernel default, which is also
<code>0</code>, but leaves nothing documenting the intent.

Turning forwarding off stops routing but leaves the NAT and filter rules loaded.
To stand the router down completely, flush them as well — see
[[#Tearing it down|Tearing it down]].

{{Box|1=systemd-networkd can set forwarding itself, but the option was renamed: <code>IPForward=</code> in <code>[Network]</code> is deprecated from systemd 256 in favour of <code>IPv4Forwarding=</code> / <code>IPv6Forwarding=</code>. <code>sysctl</code> behaves the same on every version, so the examples above use it.}}