Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2 ip adresses on the Internet who redirect on the same machine. On this machine, one Debian runs on OpenVZ. I can set iptables rules to redirect all http request to the Debian.

    iptables prerouting -d ip_address_2 DNAT --to ip_address_local_1
                     |              |
                     |              V
I|                 +------+     +----------+
N|ip_address_1     |      |-----|Debian1 VE|-- Apache's log
T|-----------------|OpenVZ|     +----------+   [client ip_address_1]
E|              |  |      |
R|ip_address_2  |  |      |
N|--------------+  |      |
E|                 +------+

Iptables' rules :

iptables -t nat -A PREROUTING -p tcp -i eth0 -d ip_address_2 --dport 80 -j DNAT --to
iptables -A FORWARD -p tcp -i eth0 -o venet0 -d --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -i venet0 -o eth0 -s --sport 80 -j ACCEPT

When I go to webpage with "http://ip_address_2", I can see the good content but the ip address on access log file is ip_address_1, I would like to see my ISP's ip address.

If I type :

# iptables -t nat -L -n

target     prot opt source               destination         
DNAT       tcp  --            ip_address_2       tcp dpt:80 to: 

target     prot opt source               destination         
MASQUERADE  all  --             
SNAT       all  --            to:ip_address_2 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   

Any ideas?

share|improve this question

perhaps this is as simple as adding Listen in your httpd configuration?

and removing any Listen 80 directives, to make sure the server is only serving the IP address you want.

i just re-read your iptables rules; you're sending traffic from ip2 on port 80 to ip1 on port 80... of course your logs are going to show ip1. you're redirecting the traffic before it hits the server.

share|improve this answer
No, I'm sending traffic from ip2:80 to ip_local_1:80 (not ip1) – Kevin Campion May 14 '10 at 21:28
again, i think limiting apache to the IP you want might be your best solution, then. – cpbills May 15 '10 at 16:10
I have already add NameVirtualHost ip_address_2:80 in apache2.conf – Kevin Campion May 15 '10 at 17:36
that is not the same as Listen ip_address_2:80 – cpbills May 15 '10 at 21:08
If I do this, I have these errors : # /etc/init.d/apache2 restart * Restarting web server apache2 (99)Cannot assign requested address: make_sock: could not bind to address ip_address_2:80 no listening sockets available, shutting down – Kevin Campion May 15 '10 at 21:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.