Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a host that acts as a gateway for other hosts. The configuration is such that eth0( is connected to internet via a router and eth1( is connected to internal network via switch. Given that, this host is also running a service that is bound to eth1 and serves the internal network. I want to extend this service to the outside world as well and was trying to manipulate iptables so that any request that comes to this host via eth0 and is directed to is send to and internet users can also make use of the service.

Here are my iptable rules for setting up the host as gateway (and these work fine):

sudo iptables -t nat -A POSTROUTING -s -o eth0 -j MASQUERADE
sudo iptables -t nat -A POSTROUTING -s -o eth1 -j MASQUERADE
sudo iptables -A FORWARD -s -o eth0 -j ACCEPT
sudo iptables -A FORWARD -d -m state --state ESTABLISHED,RELATED -i eth0 -j ACCEPT

And these are the rules that I am trying to add to the iptables to achieve my ends:

sudo iptables -A INPUT -d -p tcp -dport 80 -i eth0 -j ACCEPT
sudo iptables -t nat -A PREROUTING -d -p tcp -dport 80 -j DNAT --to-destination
sudo iptables -t nat -A PREROUTING -s -p tcp -sport 80 -j SNAT --to-source
sudo iptables -A FORWARD -d -p tcp -dport 80 -m state --state ESTABLISHED,RELATED -j ACCEPT

When I do so, I get error like : "multiple -d flags not allowed" ... Can someone tell me how to resolve this error... and do the entries that I want to add will serve my purpose ?


share|improve this question
up vote 2 down vote accepted

As @Vladimir said, you need to write the --sport and --dport using double dashes. Using single dash for -dport confuse iptables about using another -d option.

For rules correctness, it is enough to add this rule to achieve your goal:

iptables -t nat -A PREROUTING -d -p tcp --dport 80 -j DNAT --to-destination

This should work assuming you are receiving traffic from Internet (from your router) on the IP (public to private NAT is done in the router).

Also, you can write the RELATED/ESTABLISHED rule only once and in this form:

iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

Just allow all related/established connections. This should not be a security hole as your are allowing only relevant traffic using other FORWARD rules.

share|improve this answer

Both --sport and --dport parameters require 2 dashes in front of them, I guess this is causing the errors you get.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.