Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My server has several public IPs, and is running a bunch of virtual machines with private IP adresses.

As an example, I want to map ports 80, 443 and 8080 on (public) to (private). I have tried a couple of different NAT mappings, but none of them seem to work:

# This doesn't work.
DNAT           net              loc:  tcp  80,443,8080  - 

# Neither does this.
DNAT           $FW              loc:  tcp  80,443,8080  - 

# Nor this.
DNAT           net: loc:  tcp  80,443,8080

# I have no idea what I'm doing.
DNAT           $FW: loc:  tcp  80,443,8080

Can anyone point me in the right direction?

share|improve this question
up vote 1 down vote accepted

Your first rule is correct:

DNAT    net loc:  tcp 80,443,8080 -

So the problem must lie elsewhere. You can see the underlying iptables rules created with this:

iptables -t nat -nvL net_dnat

NATed packets still need to traverse the FORWARD chain and be accepted. Try adding the following rule to accept traffic to the VMs on these ports:

ACCEPT  net loc:  tcp 80,443,8080
share|improve this answer

As an additional comment to the previous answers, make sure the order in which you place rules.


Let's say you configured your rules like this:

DNAT net loc: tcp 80 DNAT net loc: tcp 80 200.x.y.z

If you wanna get to on port 80, you will always end up in because the destination address is the default

So if you wanna get to trough public ip address 200.x.y.z, you should modify the order of the rules:

DNAT net loc: tcp 80 200.x.y.z DNAT net loc: tcp 80

Or modifiy the default address of the first rule.

I hope it helps!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.