Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server handling several services. For the purposes of this questions, suppose one of them is mail. If mail goes down, I want to forward it to another host. My network looks like this:

-- Network 1 --

Box 1

-- Network 2 --

Box 2

So... Incoming requests are coming to the address on eth1 on box 1. Instead of stopping there, I want to forward them over eth0 to box 2 and let that handle it.

I've tried the following iptables rules:

iptables -t nat -A PREROUTING -p tcp -m tcp -d --dport 25 -j DNAT --to-destination
iptables -A FORWARD -m state -p tcp -d --dport 25 --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -p tcp -m tcp -s --sport 25 -j SNAT --to-source

... To no avail. Using tcpdump, I can see the request come in on the 2nd box, but nothing happens on the requesting computer.

Please help. Thanks!

share|improve this question
Is there a reason youre not using some sort of HA solution (such as pacemaker)? Migrating resources in the event of a failure is exactly what it was made to do. – Patrick Mar 29 '12 at 3:09
As for the reason it fails, its because 'box 2' is sending traffic back to the original host, but now its coming from the wrong IP. The traffic has to flow back out box 1 so that it can rewrite the reply packet to come from the address (thats not what your 3rd rule is doing. I cant tell what youre trying to do with that one) – Patrick Mar 29 '12 at 3:14

If you need help with this, I suggest that you show full iptables ruleset. A few packets from tcpdump wouldn't hurt either.


Do you have ip forwarding enabled? Check with:

sysctl net.ipv4.conf.all.forwarding

Set with:

sysctl net.ipv4.conf.all.forwarding=1

Make permanent by adding to /etc/sysctl.conf (or where your distribution expects it).

You need to allow forwarding for the opposite direction as well, add a forward rule for -s and -o eth1 too (in case you dont have that, or a catch-all/default policy ACCEPT already):

iptables -A FORWARD -s -o eth1 -j ACCEPT
share|improve this answer
That really is the full iptables ruleset - the box is not doing anything else with iptables. – Erick Mar 28 '12 at 6:47
The forwarding is enabled. – Erick Mar 28 '12 at 6:48

Ended up using xinetd to deal with mail for now.

service smtp
        disable = no
        socket_type     = stream
        wait            = no
        user            = root
        redirect        = 25
        log_on_failure  += USERID

Thanks for your help everyone!

share|improve this answer

A few comments in general:

  • You probably want to match on interfaces as well as just tcp/ip source/destination/ports
  • I'm not really sure the POSTROUTING/snat rule is needed, for what you're trying to accomplish. DNAT have already translated the source address of the packet before POSTROUTING.

One possible reason you weren't seeing any replies at the client could be the routing table on Box 2. DNAT doesn't rewrite the source-address, and in order for DNAT to work, Box 2 needs a route back to the source that goes through Box 1. If this is "an arbitrary ip address", Box 2 would need it's default route via Box 1, if it's specific networks, return routes to those networks through Box 1 would do.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.