Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Linux box with multiple IPs, I'm having a problem redirecting a privileged port to an unprivileged port on which a server is listening that's bound to a specific IP.

Add this rule to iptables to redirect incoming traffic from port 80 to 8080:

iptables --table nat --append PREROUTING --protocol tcp --dport 80 \
    --jump REDIRECT --to-ports 8080

Then start a netcat to listen on all IPs, port 8080:

nc -l 8080

Then send a packet to port 80 from another machine:

echo foo | nc
echo foo | nc

Both these packets are received. Now for the strange thing. When you make netcat listen on a specific IP, it doesn't see the redirected packet.

nc -l 8080

Now the packet sent to port 80 is not received; only the packet on port 8080. The difference is obviously how the server binds the listening port -- works but a specific IP doesn't.

The problem is not in netcat, because nginx (where I do IP-based vhosting) has the same problem.

I tried to extend the iptables rule by specifying that the destination address is, but this still doesn't work.

share|improve this question
up vote 0 down vote accepted

Redirecting, or transparently masquerading the thing away from your client applications? If you want transparency, something like this might work

iptables -A PREROUTING -t nat -p tcp -m tcp --dport 80 -j DNAT --to-destination
iptables -A OUTPUT -t nat -p tcp -m tcp --dport 80 -j DNAT --to-destination
share|improve this answer
That works as expected. To make IP-based vhosting work, you have to also filter by --dst: iptables -t nat -A PREROUTING -p tcp -d --dport 80 -j DNAT --to-destination Now you can start two servers listening on different IPs but the same ports, and send a packet to one or the other. I was just using the iptables terminology, they call it "redirecting" there. – j0057 Sep 22 '11 at 10:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.