Your sysctl says one thing, the kernel says another
You set net.ipv4.ip_forward=1 in /etc/sysctl.conf . You rebooted. The value is still 0 . Nothing is broken, and you did not make a typo. On a host running UFW, there is a second sysctl file, and it wins . Two files, one kernel UFW ships /etc/ufw/sysctl.conf and loads it when the firewall comes up. It takes precedence over /etc/sysctl.conf . Anything you set in the familiar file that UFW also sets…
A sysctl configuration may appear correct in a file, but the kernel may be applying a different value. This discrepancy can lead to issues like a WireGuard tunnel with no traffic. The primary reason for this behavior is the presence of a second sysctl file managed by UFW, which takes precedence over the original /etc/sysctl.conf file.
When UFW is enabled, any settings made in /etc/sysctl.conf are overwritten silently, without any warning or log entry. This can be a time-consuming issue as users may repeatedly check the same file they edited, believing it to be correct.
To check the effective sysctl values, users should look in /proc/sys/net/ipv4/ip_forward instead of relying solely on the file /etc/sysctl.conf. The notation may use slashes in the latter, which can cause confusion when searching for the correct configuration. A helpful script has been created to compare effective sysctl values against hardening recommendations and flag any discrepancies, making it easier for users to identify and resolve the issue.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
