Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a service setup that redirects after a succesfull login (Couchbase), but the IP it transfers to is an local one, where the client that is connecting to cannot reach.

How can I setup iptables so that I can route traffic generated by the client itself to another port?

  • Client connects to server1
  • Server1 sends Client the ip to connect to (Which is local to server1, not Client)
  • Client gets redirected to (Can't reach)
  • IPTables routes all traffic that is send to to outside_ip:11210

The HTTP service just returns and IP to connect to, thus 'redirecting' the Client, but not with a HTTP Redirect.

I'm not confortable with IPTables so I'm not eager to experiment with it/mess up and lose my ssh connection, I've seen some examples but none of them seem to work or do exactly what I want.

share|improve this question
Is the port always the same and is this TCP traffic? – DerfK Jul 12 '12 at 13:06
Can you clarify what's going on? If the client is getting an HTTP redirect to, then there's nothing you can do, as the client is looking for a service on his local network. – cjc Jul 12 '12 at 13:07
@DerfK The port is always the same and indeed TCP traffic. – WesleyE Jul 12 '12 at 13:15
@cjc It is not a HTTP redirect, it simply gets a server to connect to from the http service. But the ip it gets from the HTTP service is a internal ip which is not available. – WesleyE Jul 12 '12 at 13:17
How can you "get a server to connect to from the http service" without it being a redirect? Perhaps in the HTTP response body, but that's still not something you traditionally do with iptables. Try explaining to your web service that it should stop being a know-it-all and listen to what you have to say about it's proper address. Or just stop using NAT. – womble Jul 12 '12 at 13:55
up vote 2 down vote accepted

If you cannot get the webservice to give a valid routable public IP address to the client, it's never going to work unless you write the client to ignore the IP address provided by the webservice. iptables cannot fix this (without writing a protocol inspection module like ip_masq_ftp, and then assuming you're not using SSL).

If you can get the webservice to give a proper public IP of a computer that has access to the internet and to the private network, then the simplest thing to do would be to have rinetd running on that machine, listening on the internet side and forwarding connections to the private side, but for this to work, the port has to be consistent for the same IP (you can have multiple ports redirected, but incoming port 11210 always has to go to (you can redirect to a different port, so if you have ...53:11210 and ...54:11210, you can use :11211 to redirect to one of them, but the webservice will need to know this).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.