Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to forward all incoming traffic from a certain port to another one using iptables. The problem is that prerouting doesn't work for traffic from localhost. This topic suggests a solution:

iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8080
iptables -t nat -I OUTPUT -p tcp -d --dport 443 -j REDIRECT --to-ports 8080

This solution does work for most cases. However, when I connect to http://myserver:443 where myserver resolves to an IP address that is hosted on the local machine, but is not it seems to bypass both rules.

Is there a way to also catch forwards requests from the local machine that are done to the eth0 ip address?

share|improve this question
Here's a really useful answer:… – Warren T. May 16 '14 at 4:39
up vote 2 down vote accepted

Instead of doing -d on the OUTPUT rule, you could do -o lo. This will match any traffic going through the loopback interface no matter what the destination is.

As a side note, even when you send to 'http://myserver:443', the traffic is still local, so it still goes through the loopback interface, even though it doesnt resolve to ''.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.