Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux router like:

İnternet <-> Linux <-> DMZ

We have /25 subnet of 128 IP addresses. Those are NATed into servers in DMZ. If I did not configure all of these IP addresses as IP aliases in external interface of Linux, those IPs did not work.

Lets example, IP is not defined in Linux. I see packets targeted to at external interface of Linux with tcpdump. However, NAT rules does not work. If I define as eth1:1 at external interface, NAT rules start to work.

Kernel is 2.6.18 latest Centos 5.5 kernel.

I need your kind comments.


share|improve this question

migrated from Jun 14 '11 at 7:55

This question came from our site for professional and enthusiast programmers.

My comment is your network as working as NAT is designed. Without configuring the public IP address for the NAT, the NAT cannot work.

Interface alias is one way to solve the addressing problem. For a more modern ip addressing tool, please see iproute2.

share|improve this answer
The important point is packets are already routed by frontend router. I see the packets in incoming interface already. The point is that, NAT does not work until I add the destiation IP as IP alias. – seaquest Jun 14 '11 at 17:14
Routing is necessary but not sufficient. You need the destination as you've learned. – dmourati Jun 14 '11 at 18:59
This is al Lİnux router. It should be able to process(route, NAT etc) packets not destined to itself. – seaquest Jun 15 '11 at 4:22
You have two choices: either NAT as you mention above, or route the IP to the target. If you NAT, the public IP must live on the NAT device. It seems you need to read and understand the Linux NAT howto, specifically: While that section pertains more directly to SNAT and you are speaking above more about DNAT, the requirement still holds. – dmourati Jun 15 '11 at 5:57
Actually I read most ofthe howto. The specific page says the packets you NATed should come back to you for deNAT. No problem. In my case I am already the router and all of the packets has to come to my router. – seaquest Jun 17 '11 at 20:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.