Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I can't figure out iptables and I don't know very much about networking and I'm really hoping that someone out there can help me.

I have a server with two ip addresses associated with it: and

Running Ubuntu 10.04

Here is my ifconfig:

eth0      Link encap:Ethernet  HWaddr 00:16:3e:xx:xx:xx  
          inet addr:
          inet6 addr: xxxxxxxxxxxxxxxxxxxxxxxx Scope:Link
          RX packets:8601280 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2520243 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:1736805563 (1.7 GB)  TX bytes:412953236 (412.9 MB)

eth0:0    Link encap:Ethernet  HWaddr 00:16:3e:xx:xx:xx  
          inet addr:

lo        Link encap:Local Loopback  
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1216209 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1216209 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:13294196379 (13.2 GB)  TX bytes:13294196379 (13.2 GB)

Everything works fine: when I type or into the address bar of a browser, I get the default Apache2 page as expected.

Now, I have an application that runs in the browser which has a WebSocket connection over port 8000. I serve the page over port 80 (http) as usual using, and I have the WebSocket communicating behind the scenes with over port 8000. Everything's fine.

Now I plug in my 3G modem which blocks port 8000. My WebSocket communication to fails.

I want the WebSocket to communicate with over port 80, but get the server to translate requests on to

I found this: meteorserver dot org/installation/ (see section 6) but it didn't work ;( I also tried this: but it gave me the following error:

ubuntu> sudo iptables -t nat -A PREROUTING -i eth0:0 -p tcp --dport 80 -j REDIRECT --to-port 8000
Warning: weird character in interface `eth0:0' (No aliases, :, ! or *).

Apparently IP aliases aren't supported ;( I tried putting eth0:0 in quotes and it still wouldn't work.

I'm completely stumped.

share|improve this question
possible duplicate of iptables: IP alias and redirection... – Evan Anderson Aug 6 '10 at 1:38
possible duplicate of iptables: IP alias and port forwarding. – Zoredache Aug 6 '10 at 1:51
up vote 9 down vote accepted

You're on the right track. You don't have to specify the "alias" input interface. From an iptables perspective the input interface is still eth0, even if the destination IP address is Try this way instead:

iptables -t nat -A PREROUTING -i eth0 -d -p tcp --dport 80 -j REDIRECT --to-port 8000

That should do what you're looking for.


You want "eth0" in that command-- not "eth0:0" (which isn't legal). The physical interface the packet is entering on is "eth0", which is all iptables is concerned about.

Unless the protocol you're using is UDP-based you don't need a corresponding "-p udp" entry.

To see what's in your "PREROUTING" chain now, do an iptables -t nat -L. You can delete individual entries from the chain by using the iptables -t nat -D PREROUTING x where "x" is the sequential count of the entry in the chain you want to delete (the first one is "1", the second is "2", etc) as displayed by iptables -t nat -L.

share|improve this answer
Hey, thanks so much for that. Should that be "-i eth0" or "-i eth0:0"? Also, do I need to do this for udp as well? i.e the same command with "-p udp" option? I don't want to do anything for fear of breaking my server. I don't know how to undo ipconfig commands ;( So, do I even need that ip alias I've created? – Eamorr Aug 6 '10 at 0:27
Also, I tried that and it didn't work for me ;( I'm also worried my iptables are messed up... – Eamorr Aug 6 '10 at 0:33
@Eamorr: I dropped on an edit. – Evan Anderson Aug 6 '10 at 1:00
Ok, it's working now. Server receiving messages sent over port 80 on redirecting into Thanks so much for that. I've another problem now... Chrome is returning this error: Error during WebSocket handshake: location mismatch: ws:// != ws:// Probably another question... – Eamorr Aug 6 '10 at 1:46

Don't match on the device name. Try just matching based on the IP

sudo iptables -t nat -A PREROUTING --destination -p tcp --dport 80 -j REDIRECT --to-port 8000
share|improve this answer

I'll answer your question with other question :D

Q: How can I use aliased network interfaces with your firewall (like eth0:0) in rules?

A: The current Linux implementation doesn't allow distinction between eth0 or eth0:0 in eg. iptables/netfilter rules. You can only specify eth0 which automatically includes eth0:0 (and other aliased interfaces). You can however use the IP address of the aliased interface for rules.

Check this out:

Linux iptables: Port Redirection Example

share|improve this answer

Another approach : use virtual interfaces (macvlan).

Ip aliases are a higher level trick and iptables will see just one interface (the real one). You can avoid the problem using directly ip ranges as suggested.

With vlan interfaces you shouldnt have any problem with netfilter/iptables as they behave like normal interfaces at the kernel level. To add a new one (you dont need to specify the mac) :

ip link add link name_real_if address mac:virt:if name_virt_if type macvlan

This way you work directly at osi2, indeed you could use them in bridges configurations, make firewall/qos rules idependently of ip assignments...

It took me a while to find this solution, Id always used ifconfig eth0:0, its fast and usefull but its maybe time to migrate to iproute2.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.