Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Some background:

A firewall has been constructed using RH Fedora 13, Kernel, and IPTables 1.4.7. The firewall is a simple, twin adapter configuration, with the external interface (eth0) facing the internet, and the other interface (eth1) facing a small private network (single IP subnet). The firewall is a bastion host, meaning that the firewall host contains nothing but the operating system, IPTables, and only those items needed to support operation of the host itself. The firewall does not run any other applications.

Contained within the private network is a web server.

Network: Base Address: Web Server: Clients: located at various addresses on the subnet. Firewall eth1 Address: DNS Address:

QUESTION Given that clients on the internal network can freely surf the internet: if the clients select a specific web site (ie, my goal is to configure IPTables to instead redirect the client to the internal web server.

  • If the client web browser is going to surf, then iptables redirects the client to
  • If the client web browser is going to surf any other website, then iptables permits the client to forward to the internet.

I have attempted several iptables rules, including:

iptables -v -t nat -A PREROUTING --in-interface eth1 --dport 80 -d -j DNAT --to

However, this appears to have no effect.

Can you please recommend the rule I should be using to perform this feat?

share|improve this question
Dear All: Thank you for the several answers that have been proposed. However, the answers seem to make a few assumptions. Please permit me to clear those assumptions: 1) No NEW packets are permitted from the internet in to the protected environment. 2) This internal web site is already being used by clients. This internal web site is not accessible from outside the firewall. 3) I am trying to prevent clients from accessing a web site outside of the firewall, and instead, drive those clients to the existing web site inside the protected network. THANK YOU!!! – iic1tls Dec 14 '10 at 20:12

2 Answers 2

Assuming you can do this with iptables, and I'm not sure you can because of the unrouted nature of the return traffic from to the clients, you'll redirect all web hosts that live on the ip address associated with

That's unavoidable, because iptables is essentially a layer 3 tool and deals with ip addresses not HTTP hostnames.

I think you would do better to install a squid proxy on your internal network, configure that to perform the redirection for one domain name, and reconfigure your clients to use the proxy. You may also wish to use iptables on the bastion to prevent all http traffic in and out of your internal network, to ensure that the proxy is used.

share|improve this answer

Below is the syntax I use for a similar rule, but my traffic is for external to internal.

-A PREROUTING -i eth0 -p tcp -m tcp -d X.X.X.X --dport 80 -j DNAT --to-destination Y.Y.Y.Y:80

You also need to make sure you have ip_forward enabled and the correct forward rules to allow the traffic back.

share|improve this answer
I think this would probably work for traffic between two disparate subnets, but in this example, the traffic has to remain on the subnet, and not be routed. Therefore, would DNAT be used? – iic1tls Dec 14 '10 at 16:22
No, hence my point below about the unrouted nature of the traffic. I don't think you can do this with simplistic iptables, because the return hop never passes through the bastion host to get de-DNATted. The clients will make a TCP connection to (say), get DNAT-connected to, and the return traffic will come from TCP won't like that at all. – MadHatter Dec 14 '10 at 16:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.