Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When x.x.x.x makes a request on port 80 to y.y.y.y I would like the request to be redirected to z.z.z.z:80. Is it possible to do this by adding rules to iptables on y.y.y.y?

share|improve this question

You probably want to use DNAT to rewrite the destination IP address, something like this:

iptables -t nat -A PREROUTING -p tcp -s x.x.x.x -d y.y.y.y --dport 80 -j DNAT --to-destination z.z.z.z:80

share|improve this answer
For this to work you also need to enable IPv4 forwarding. echo 1 > /proc/sys/net/ipv4/ip_forward – Kenny Rasschaert Nov 30 '11 at 13:36
Plus, if x.x.x.x, y.y.y.y, and z.z.z.z are in the same subnet, a -j SNAT rule will also be necessary. – pepoluan Nov 30 '11 at 14:11
I haven't done anything with SNAT yet - maybe I need to, x.x.x.x and y.y.y.y are on the same network? Initially the connection times out and after echo 1 > /proc/sys/net/ipv4/ip_forward it fails more quickly. – James Nov 30 '11 at 15:02

Final solution as follows:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp -s x.x.x.x -d y.y.y.y --dport 80 -j DNAT --to-destination z.z.z.z:80
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

where eth0 is outside interface on y.y.y.y.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.