A Linux host only forwards packets between its interfaces if you tell it to. When a box is supposed to act as a router, NAT gateway, or VPN endpoint but clients behind it can't reach anything, the cause is often a single kernel toggle: net.ipv4.ip_forward is 0. The gateway receives the transit packets and quietly drops them.
Check the toggle
sysctl net.ipv4.ip_forward # 0 = forwarding off cat /proc/sys/net/ipv4/ip_forward # same value, read directly
Enable it now, and persist it
sysctl -w net.ipv4.ip_forward=1 # takes effect immediately # persist across reboots — in /etc/sysctl.conf (or a file in /etc/sysctl.d/): net.ipv4.ip_forward=1 sysctl -p # reload from config
The sysctl -w change is live but resets on reboot, so always add it to /etc/sysctl.conf as well. Forwarding is necessary but not sufficient for NAT — you also need the right firewall/masquerade rules — but if forwarding is off, nothing else matters.
Practise it
Gateway-forwarding incidents are part of the simulator's networking set. Work them in a full incident response shift.