the best way to nat between ethernet card is to add the following lines to the file /etc/rc.local
echo 1 > /proc/sys/net/ipv4/ip_forward # Enables packet forwarding
echo 1 > /proc/sys/net/ipv4/tcp_syncookies # DOS flooding
echo 1 > /proc/sys/net/ipv4/conf/all/rp_filter # source address verification (spoofing)
echo 1 > /proc/sys/net/ipv4/conf/eth0/rp_filter # source address verification (spoofing)
echo 1 > /proc/sys/net/ipv4/conf/eth1/rp_filter # source address verification (spoofing)
# Delete and flush. Default table is "filter". Others like "nat" must be explicitly stated.
iptables --flush # Flush all the rules in filter and nat tables
iptables --table nat --flush
iptables --table mangle --flush
iptables --delete-chain # Delete all chains that are not in default filter and nat table
iptables --table nat --delete-chain
iptables --table mangle --delete-chain
# Set up IP FORWARDing and Masquerading
iptables --append FORWARD --in-interface eth0 --out-interface eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables --append FORWARD --in-interface eth1 --out-interface eth0 -j ACCEPT
iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
in the example, eth0 attaches to the isp and eth1 attaches to a vpn.
eth0 and eth1 must still be configured for an appropriate ip number. this does not provide dhcp server, but does support static ips.