Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First here is the basic topology:

                       |     |     |
                      vm1   vm2   vm3 

I need to test a traffic analyzer running on my workstation, listening on some port (say 8990) on eth0.

The rule [I think] I want is "any packets leaving virbr0 going anywhere to port 80 must instead go to port 8990 on eth0". My software running on port 8990 does its own check of the NAT packet mangling to push the packets through after it inspects them.

I've been banging my head on this, with different variants of:

iptables -t nat -A PREROUTING -i virbr0 -p tcp --dport 80 -j DNAT \

And I've tried the more generic method of using the mangle table with --set-mark and ip rule add fwmark, but I'm not getting it.

I guess what's confusing me is that everything runs on the same box.

Thanks for any guidance.

share|improve this question

Turns out this question is moot. Tcpdump shows that the subnet for the VM's,, never even appears in the kernel routing decision. I guess libvirtd does its own network handling before handing off to the kernel network stack.

Back to the drawing board.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.