Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up following ip tables rule:

sudo iptables -t nat -I PREROUTING --dst  -p tcp --dport 80 -j REDIRECT --to-ports 8000

sudo iptables -L -t nat
target     prot opt source               destination
REDIRECT   tcp  --  anywhere             static.snake2.test tcp dpt:www redir   ports 8000

target     prot opt source               destination

Chain OUTPUT (policy ACCEPT) target prot opt source destination

That will forward any traffic on port 80 on the given ip to port 8000 on the same ip. Works perfectly through a browser.

What does not work is, if I try to run some test directly from console:

lynx -head -dump

or what I intended to do

ab -n 1000 -c20

In that case the forwarding rule simply does not work. The header given back is still from port 80 (apache) and not like expected from nginx (8000).

share|improve this question
Can you please edit your question to contain the contents of iptables -L? – MDMarra Feb 20 '12 at 16:05
I have just added the output – merlin Feb 20 '12 at 16:51
up vote 3 down vote accepted

I'm pretty sure that the reason you are seeing this is that the PREROUTING chain is not applicable to the packets that go via the loopback interface. When you say it works from a browser, I assume you mean from another machine, in which case your rule will apply. You'll need to add a rule to the OUTPUT chain too to get it to work on the localhost traffic. Something like this:

iptables -t nat -I OUTPUT --source 0/0 --destination 0/0 -p tcp --dport 80 -j REDIRECT --to-ports 8000
share|improve this answer
you are right! neptun:~$ lynx -head -dump HTTP/1.1 200 OK Server: nginx @snake2:~$ lynx -head -dump HTTP/1.1 200 OK Date: Mon, 20 Feb 2012 17:12:04 GMT Server: Apache/2.2.21 (Unix) mod_ssl/2.2.21 OpenSSL/1.0.0e Do you know how I can add a rule to the OUTPUT chain to make that work? – merlin Feb 20 '12 at 17:14
I haven't tested this, but I would expect something like the rule I added above would do it. – Adam C Feb 20 '12 at 17:33
Perfect! Works excellent. Thank you for your help. – merlin Feb 21 '12 at 10:11
excellent :) if you can accept the answer I'd appreciate it - need the help on the rep front ;) – Adam C Feb 21 '12 at 10:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.