Forwarding packets from specific domain (TLD) to a certain machine in network using iptables

Question

I am able to port forward using following commands:

iptables -t nat -A PREROUTING -p tcp -d XXX.XXX.XXX.XXX --dport 80 -j DNAT --to 192.168.161.31:80

iptables -t nat -A POSTROUTING -d 192.168.161.31 -j MASQUERADE

I wanted to use if it is possible to forward packets aimed at a domain name instead of an IP address like XXX.XXX.XXX.XXX.

For instance, can one do something like the following and make it work? Mine does not work!

iptables -t nat -A PREROUTING -p tcp -d XXX.XXX.XXX.XXX --dport 80 -j DNAT --to 192.168.161.31:80
iptables -t nat -A PREROUTING -p tcp -d www.example.com --dport 80 -j DNAT --to 192.168.161.32:80

Please notice that the preceding commands should forward to different machines.

Answer 1

No it is not possible. Packets are never aimed at domain names at the TCP/IP level.

You'll need to use some sort of load balancer (apache with ProxyPass, for instance) if you need to redirect requests to another host/port.

Answer 2

No you can't do something like that. DNS names are not allowed in netfilter rules. They only apply on TCP/IP and ICMP levels.