Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My server has several public IPs, and is running a bunch of virtual machines with private IP adresses.

As an example, I want to map ports 80, 443 and 8080 on (public) to (private). I have tried a couple of different NAT mappings, but none of them seem to work:

# This doesn't work.
DNAT           net              loc:  tcp  80,443,8080  - 

# Neither does this.
DNAT           $FW              loc:  tcp  80,443,8080  - 

# Nor this.
DNAT           net: loc:  tcp  80,443,8080

# I have no idea what I'm doing.
DNAT           $FW: loc:  tcp  80,443,8080

Can anyone point me in the right direction?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Your first rule is correct:

DNAT    net loc:  tcp 80,443,8080 -

So the problem must lie elsewhere. You can see the underlying iptables rules created with this:

iptables -t nat -nvL net_dnat

NATed packets still need to traverse the FORWARD chain and be accepted. Try adding the following rule to accept traffic to the VMs on these ports:

ACCEPT  net loc:  tcp 80,443,8080
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.