What is IP forwarding and how to do it

IP forwarding is a networking function that allows a device to move IP packets between different networks or network segments. When a packet arrives, the forwarding device checks the destination IP address, consults its routing table, and sends the packet to the correct next hop.

This is different from local file sharing, switching, or communication between two devices on the same wifi network. In these everyday networking scenarios, traffic stays within the local network rather than crossing a separate network boundary, so you don’t need IP forwarding.

In this guide, I explain what IP forwarding does, how it differs from IP routing, NAT, and port forwarding, and when to use it. I also show you how to enable IP forwarding on Linux and Windows, explain the security risks, and help you troubleshoot errors that stop traffic reaching the intended device.

How IP forwarding works

IP forwarding allows a device to receive a packet from one network and forward it to another. Your router does this every time it moves traffic between your home network and the wider internet. The process has three basic stages: the forwarding device checks the packet, chooses a route, and sends it to the next network.

1. The forwarding device checks where the packet needs to go

When a packet reaches a router, gateway, or another device with IP forwarding enabled, it checks the destination IP address. If the packet is valid and not intended for the device itself, it treats it as transit traffic. It then forwards the packet to the next hop, which could be another router, a gateway, or a device on a directly connected network segment.

2. The routing table decides the next hop

The forwarding device checks its routing table to find the best path. If more than one route could work, it chooses the route that most closely matches the destination address. This is called the longest prefix match. If no suitable route is found, the forwarding device may forward the packet to a fallback next hop (default gateway) or drop it.

3. The packet is sent to the next network

Before forwarding the packet, the forwarding device reduces the Time to Live (TTL) value by one. This stops packets from looping forever if they get stuck on a broken route. It then wraps the packet in a new local network frame and sends it to the next hop. On IPv4 networks, the ARP protocol is used to find the correct MAC address for the next hop.

Why don’t normal computers forward packets by default?

Devices running Windows, macOS, and Linux usually drop packets that are not addressed to them. This is deliberate security that prevents a laptop or desktop from acting as a router unless you have specifically configured it to do so.

This improves security by stopping misconfigured devices from forwarding traffic without your knowledge. Without this safeguard, one network could be exposed to another, firewall rules could be bypassed, or an attacker who compromises one device could gain an unintended path into another part of your network.

When you enable IP forwarding, you deliberately allow the device to pass traffic between networks. Your chosen device can now act as a gateway. This can be useful, but it needs to be managed carefully with robust firewall rules that control what traffic is allowed to pass through.

IP forwarding vs IP routing, NAT, and port forwarding

IP forwarding, IP routing, NAT, and port forwarding are closely related, but they each do a different job. This can cause confusion because routers and gateway devices often use several of these processes simultaneously.

IP forwarding vs IP routing

IP routing is the process by which a device learns which paths are available. Your router (or another device you use for routing) uses this information to build a routing table that stores known routes and helps it forward packets quickly when they arrive.

With the routing table in place, IP forwarding uses it to send each packet through the correct network interface to the next hop. Think of it like this: routing builds the map, and IP forwarding moves the packet along the chosen route.

IP forwarding vs NAT

Network Address Translation (NAT) is an address-translation process that allows all the devices in your home to communicate with the internet independently, even when they share the same public IP address. Your router does this by replacing each device’s private IP address with the router’s public IP address as traffic leaves your home network.

IP forwarding and NAT often work together inside your home router, but they do different jobs. The router forwards traffic between your home network and the wider internet, while NAT changes the address information so replies from websites, apps, and services can find their way back to the correct device.

The crucial thing to remember is that your router handles these processes invisibly in the background. You do not need to configure IP forwarding or NAT manually for everyday browsing, streaming, gaming, or VPN app use.

IP forwarding vs port forwarding

Port forwarding allows you to route incoming traffic to a specific app or service on your network. Think of it as telling your router: “When traffic arrives on this port, send it to this device.” Whereas IP forwarding connects different networks or network segments, port forwarding provides remote access to one app or service behind your router.

For example, you might forward a port to a torrent client, a game server, a Plex server, a website, or a remote-access tool. This is useful, but it creates a security opening because that service becomes reachable from outside your network. Attackers may be able to probe the exposed port for weak passwords, misconfigurations, or unpatched vulnerabilities.

IP forwarding, routing, NAT, and port forwarding compared

When should I use IP forwarding instead of port forwarding?

You only need to set up IP forwarding if you want to connect two separate LANs, manage traffic between a guest or IoT subnet and your main network, or use a Raspberry Pi, mini PC, old laptop, NAS, or server as a gateway.

Most home internet users rarely need IP forwarding. However, port forwarding is often used to seed torrents or allow people to connect to a game server, Plex server, NAS drive, website, or security camera hosted on a device inside your home network.

How to enable IP forwarding

You should only enable IP forwarding if a device needs to route traffic between networks. On normal home devices, this setting is disabled for security reasons. Turning it on without proper firewall rules could allow traffic to move between networks in ways you did not intend. Only follow the steps below if you understand the risks and have a concrete reason to forward IP packets.

How to enable IP forwarding on Windows

On Windows, you can enable IP forwarding from Command Prompt or PowerShell using the Network Shell command. You must open the terminal as an administrator. Windows keeps IP forwarding disabled by default to prevent unauthorized traffic from being routed through your PC.

Start by checking the name of your network interface:

netsh interface ipv4 show interfaces

This will show your available network interfaces. Look for the interface name, such as Ethernet or Wi-Fi. You can also use the Idx number if the interface name is long or easy to mistype.

Next, enable IPv4 forwarding for the interface you want to use:

netsh interface ipv4 set interface “Interface Name” forwarding=enabled store=persistent

Where it says “Interface Name,” enter the interface name or Idx number you received in step 1. For example, this might be Ethernet, Wi-Fi, another adapter name, or the matching Idx number.

You can enable IPv6 forwarding in Windows using this command:

netsh interface ipv6 set interface “Interface Name” forwarding=enabled store=persistent

If you are using Windows as a gateway, you may also need to configure firewall rules, sharing settings, static routes, or NAT. Enabling IP forwarding alone does not guarantee that traffic flows correctly in both directions, and it can introduce security risks if your firewall rules do not limit access.

How to enable IP forwarding on Linux

On Linux, you can control IP forwarding using sysctl, a command-line tool for changing kernel networking settings. To enable IPv4 forwarding temporarily, use this command:

sudo sysctl -w net.ipv4.ip_forward=1

This will start forwarding immediately, but the setting will reset when you reboot your Linux machine. Changing the IPv4 forwarding setting can also reset some related Linux network settings to their host or router defaults. If you have customized other Linux network settings, I recommend checking them again afterward.

To make the change permanent, you will first need to open the sysctl configuration file:

sudo nano /etc/sysctl.conf

Now, scan for this line:

#net.ipv4.ip_forward=1

If you locate it, remove the # symbol so that IP forwarding remains enabled after rebooting:

net.ipv4.ip_forward=1

If the line is not there, add it manually as a new line at the end of the file. Just make sure to add it on a new line and check that it is not placed after a # symbol. With that done, save the file, and apply the change using this command:

sudo sysctl -p

For IPv6 forwarding, use the IPv6 equivalent in the same configuration file:

net.ipv6.conf.all.forwarding=1

Then save the file and run:

sudo sysctl -p

If you decide to forward IPv6 traffic, take extra care. Once IPv6 forwarding is enabled, Linux routes IPv6 traffic and can change how the device learns automatic network settings. Only enable it if your setup specifically needs to route IPv6 traffic between networks or network segments.

Do I need to enable IP forwarding on a router?

Home routers already forward traffic between your local network and the internet. That is their main job, and it happens automatically without you needing to tinker with any IP forwarding settings.

If you set up a consumer VPN on a compatible router, you still do not normally need to enable IP forwarding manually. In most cases, you are just adding a VPN profile, server details, or configuration files in the router admin panel.

That said, you may still need to adjust routing, NAT, firewall, or port forwarding settings depending on what you are trying to do. For example, you may need to change some settings to host a service, allow remote access, put smart home devices on a separate IoT network for improved security, or control traffic between a guest network and your main network.

When will I need to use IP forwarding?

You only need IP forwarding if you want a single device to forward traffic across a network boundary. That boundary could be between two physical networks, or between separate network segments inside the same home setup, such as a guest wifi network, IoT subnet, VLAN, VPN tunnel, virtual network, or Docker/VM network.

For example, you may need IP forwarding when you:

• Set up a Linux PC, mini PC, Raspberry Pi, NAS, or old laptop as a custom router or gateway.
• Run your own VPN server on a computer or Raspberry Pi and need it to route traffic between the VPN tunnel and your home network.
• Route traffic between your main home network and a separate guest, IoT, VLAN, Docker, or VM network.
• Use a firewall appliance or Linux box to inspect, filter, or control traffic between network segments.
• Build a home lab to learn routing, subnetting, VPNs, VLANs, Docker networking, or network security.
• Use manual connection sharing or bridge-style routing where your operating system or app does not handle the routing for you.

What does IP forwarding let a gateway device do?

When you place a Raspberry Pi, mini PC, or old laptop between two network segments, IP forwarding allows that device to pass traffic from one side to the other. For example, it might sit between your main network and an IoT subnet, a VPN tunnel, a guest network, or a lab network used for testing. Without IP forwarding, the device can receive packets, but it will not send them where you need them to go.

A gateway setup with IP forwarding lets you do several useful things: 

• Route specific devices through a VPN. You can set up a gateway so that your smart TV, streaming box, or games console uses the VPN, while the rest of your devices keep using your regular connection. This works a bit like split tunneling, but for devices rather than apps.
• Create a cheap travel router. You could connect the gateway device to public wifi in a hotel or campsite, then share a private wifi network with your own devices. Add a VPN, and you have a portable privacy gateway.
• Enforce stronger ad and tracker blocking. A Pi-hole blocks DNS requests, but a gateway setup can go further by forcing devices to use your chosen DNS and blocking bypass attempts.
• Isolate smart home devices. You could put cameras, baby monitors, speakers, and other IoT gadgets on a separate subnet and control what they can reach. This helps reduce the damage if an insecure IoT device is compromised, and it limits how much access smart devices have to your main devices.
• Create a home lab. Anyone learning routing, firewalls, VLANs, VPNs, subnets, DHCP, DNS, or traffic filtering can use IP forwarding to build a home lab. This is useful for experimenting without affecting the performance of your main network.
• Route VPN clients into your LAN. If you run your own VPN server on a Raspberry Pi or mini PC, IP forwarding lets connected VPN clients reach devices on your home network. Port forwarding may help the VPN connection reach the server from outside, but IP forwarding lets traffic move from the VPN tunnel into the LAN.
• Monitor or filter traffic. When a device acts as a gateway, traffic passes through it. This lets you use tools such as Wireshark, tcpdump, firewall logs, or DNS logs to investigate which devices are contacting unknown domains or services. Repeated connections to suspicious servers could be a sign of trojans, spyware, or other malware using command-and-control infrastructure. This kind of setup can also help you spot devices or apps that are burning through your data allowance in the background.

Do you need IP forwarding to use a VPN?

No. If you use a standard consumer VPN like NordVPN, Surfshark, Total VPN, or ExpressVPN, you do not need to configure IP forwarding. The VPN app creates an encrypted tunnel and automatically routes that device’s traffic through it.

You also don’t usually need to enable IP forwarding when setting up a VPN manually on a compatible home router, such as supported ASUS, TP-Link, or Netgear models, or routers flashed with DD-WRT or Tomato. Your router already forwards traffic between your home network and the internet. In most cases, you are simply adding a VPN client profile, server details, and configuration files to your router admin panel.

IP forwarding only becomes relevant in more advanced VPN setups. For example, you may need it when running your own VPN server, using a Raspberry Pi as a gateway, routing VPN clients into your LAN, or setting up manual gateway-style VPN sharing where the operating system or app does not handle routing for you. This does not apply to simple hotspot sharing or normal consumer VPN app use.

Is IP forwarding safe?

IP forwarding is safe as long as you enable it deliberately and control its behavior using robust firewall rules. It becomes risky if the device moves traffic between networks that are supposed to stay separate, such as a guest wifi network, IoT subnet, VPN tunnel, LAN, or WAN.

This is why Windows, macOS, and Linux keep IP forwarding disabled by default. If a device forwards traffic unexpectedly, it could allow devices on one network to communicate with, scan, or probe devices on another segmented network.

Before enabling IP forwarding, always check which network interfaces it will use, what traffic you will allow through, and whether you need to update NAT, static routes, or firewall rules to keep routing secure.

IP forwarding troubleshooting

If IP forwarding is not working, start by checking the path in both directions. In most home labs, VPN server setups, and gateway builds, forwarding fails because the setting is still disabled, the route is missing, the firewall is blocking transit traffic, or return traffic has no valid path back.

1. Check that forwarding is enabled

On Linux, check the current IPv4 forwarding setting with:

sysctl net.ipv4.ip_forward

If the result is 0, Linux IP forwarding is disabled. If the result is 1, it is enabled.

On Windows, check your interface forwarding settings with:

netsh interface ipv4 show interface

Make sure forwarding is enabled on the network interface that should pass traffic onward. If you enabled it on the wrong adapter, Windows will not route traffic as expected.

2. Check the routing table

Forwarding only works if the device knows where to send the packet next. Check the routing table to confirm that the destination network, next hop, and default gateway are correct.

On Windows or Linux, use:

netstat -r

If the destination subnet is missing, you may need a static route. If traffic leaves through the wrong interface, check the route preference and subnet mask.

3. Check the firewall

A firewall can block forwarded traffic even when IP forwarding is enabled correctly. Check that your firewall allows traffic between the interfaces or network segments you are trying to connect. This is especially important on a Linux box, Raspberry Pi, mini PC, or VPN gateway, where firewall rules must allow forwarded traffic, not just traffic addressed to the gateway device itself.

Enabling IP forwarding allows packet forwarding, but firewall rules still decide what traffic can pass through.

4. Check return traffic

If traffic goes out but replies never come back, the return path is probably wrong. This is known as asymmetric routing. This issue may occur when a device on one subnet sends traffic through your gateway, but the destination network does not know how to send replies back.

You may need a static route, NAT, or a corrected default gateway so return traffic follows the right path.

5. Use ping and traceroute

Use ping to test basic reachability:

ping 192.168.1.1

Use traceroute to see where traffic stops.

On Windows, use:

tracert example.com

On Linux or macOS, use:

traceroute example.com

If traffic loops, stops at the same gateway, or never reaches the next hop, the routing table, firewall rules, or return path probably need attention.

6. Check MTU if larger traffic fails

If your device connects to the internet, but websites, VPN sessions, or downloads hang, check the Maximum Transmission Unit (MTU). MTU controls the largest packet size that can travel across a network path, and VPN tunnels often add overhead that can cause packet-size problems.

Lowering the MTU on the VPN interface, router, or gateway can sometimes fix stalled pages, broken transfers, or connections that start but never finish. A common VPN troubleshooting range is around 1400 to 1420, but the best value depends on your setup.
Some consumer VPN apps let you change MTU in their settings, but others do not. You can check the app settings or contact support to find out. If you run your own VPN server or manage the VPN interface, you should be able to adjust the MTU manually.
Avoid blocking all ICMP traffic, because some ICMP messages help devices discover when packets are too large for the connection. This process is called Path MTU Discovery.

Frequently asked questions