Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using iptables on Ubuntu server to route a public IP to a private IP. I want to nat all traffic, including 80, 443 and ICMP.

However, it appears that ICMP isn't routing. I have a steady ping going to the public IP and it never stops, even with NAT pointing to a bogus IP.

Here are the rules that I'm using:

iptables -t nat -I PREROUTING -d -j DNAT --to-destination  
iptables -t nat -I POSTROUTING  -s -j SNAT --to-source

I tried with rules for ICMP specifically, but no such luck:

iptables -t nat -I PREROUTING -d - icmp --icmp-type echo-request -j DNAT --to-destination

Any ideas?

share|improve this question
I should mention that port 80 and 3389 routing does work perfectly so I know that everything else is setup correctly. It's just ICMP that doesn't appear to work. – Scott Forsyth - MVP Jan 26 '10 at 4:39
up vote 0 down vote accepted

Have you done any pcapping to see if the icmp packets are getting NAT'd and sent out again? Maybe they're just being accepted by the box you're running iptables on.

share|improve this answer
I believe that is what is happening, that the box running iptables is responding, rather than passing the requests on. I want to ensure that the requests are passed along so that a failure on the end machine causes the pings to start failing. – Scott Forsyth - MVP Mar 9 '10 at 14:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.