Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to redirect all HTTP/HTTPS trafic from one server to another (via IP).

I do use the ufw firewall. How can I configure it do to so?

share|improve this question

(You will need admin privileges for this, so login as root or use sudo accordingly)

One easy solution is to use iptables for that:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -m conntrack --ctstate NEW -j DNAT --to foo_serverip:80
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -m conntrack --ctstate NEW -j DNAT --to foo_serverip:443
iptables -t nat -A PREROUTING -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -j MASQUERADE

will redirect all traffic in the interface eth0 (option: -i) received on port 80 and 443 (option: --dport 80, 443) to a foo_serverip IP address on port 80 or 443.

After tested you can just save your current iptables rules with

iptables-save > /etc/iptables.rules

and restore them with

iptables-restore < /etc/iptables.rules

Knowing this, the options to restore the rules at boot time are multiple. The most simple one I can think of is to edit your /etc/rc.local and append the line /sbin/iptables-restore < /etc/iptables.rules to it.

I do not think ufw can do any of this just by itself.

share|improve this answer
if I enter this as sudo, should it work? I guess it would be lost at restart, do you know where I should put this regarding ufw? – Olivier Jul 26 '12 at 22:46
@Olivier edited, let me know if you have any further doubts. – Bruno Pereira Jul 26 '12 at 22:58

It's possible to configure ufw to make port forward to external IP

  1. edit /etc/default/ufw to accept forwarding requests

    default_forward_policy = "accept"

  2. edit /etc/ufw/sysctl.conf to allow forwarding


  3. edit /etc/ufw/before.rules, add the ff after the first comment

*nat :PREROUTING ACCEPT [0:0] -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination external_ip:80 COMMIT

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.