Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good morning one and all. In our network we have a single Linux machine that has aliased IP addresses. Each of these IP addresses sit on a network controlled by a remote router to an ISP.

We want to use our Linux box as the gateway for our internal network (10.0.0.x) and for the Linux box to then forward the outgoing traffic to one of our routers on another network.

All things i have read is about masquerading between two physical interface cards; however we have only one network card, listening to multiple IP addresses.

On the Linux box itself; it can ping and access the internet fine using one of the routers as the upstream gateway.

So our configuration is as follows:

: Linux Box 
  eth0:0 =
  eth0:1 =

: Router#1
  Connection to internet via ISP

: Network Machines
  IP: 10.0.0.x

So the question is, what is my setup for iptables/nat on the Linux box to allow it to accept packets on the 10.0.0.x subnet and route them out to the specific IP address configured for the gateway. When i try to use eth0:1 as my -d then iptables complains of invalid characters and from what I read on the internet, this was disabled in iptables (

Can someone assist please? I am sure I am missing something real obvious here; all my historical knowledge has been two separate ethX network interfaces.

thank you

Update; here is the "hackity" iptables script


iptables -F INPUT
iptables -F FORWARD
iptables -F OUTPUT
iptables -F -t nat

echo 1 > /proc/sys/net/ipv4/ip_forward

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -t nat -A PREROUTING -s -j REDIRECT --to $WIFIBACKUP

iptables -P INPUT ACCEPT
share|improve this question
up vote 3 down vote accepted

-d is for --destination, and expects an address (or net). If destination is "any", then simply don't specify it.

The redirect does not do NAT.
As you are using aliases, using -i and -o does not work. The workaround is to use -d and -s. You can negate with "!". So, for all traffic from, that has a destination that is NOT, do masquerade:

iptables -t nat -A POSTROUTING -s ! -d -j MASQUERADE

share|improve this answer
Thanks 3molo ... yes you are right, NAT is what we are looking for here. I've updated the original post – Alan Williamson Apr 6 '11 at 9:24
mmm i don't think i can do that. is a box configured/supplied by our ISP. So we can't touch that one. – Alan Williamson Apr 6 '11 at 9:35
you are genius! that was the missing link. Thank you, that works perfectly. – Alan Williamson Apr 6 '11 at 9:41
That doesn't work. I get "bad argument '' – Matt Jan 29 '13 at 5:56
The correct format is iptables -t nat -A POSTROUTING -s ! -d -j MASQUERADE – Matt Jan 29 '13 at 6:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.