Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running an iptables firewall with 5 aliased ip addresses (actual ip This machine is also my gateway out for all internal machines (192.168.18.*). My problem is, when goes out, I need my gateway to say the IP is and not Is this possible? Is there a postrouting command that will do this?

:OUTPUT ACCEPT [276:56637]

-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i br1 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br0 -o br1 -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 21 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p udp -m udp --dport 53 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m tcp --dport 2048:2248 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

:PREROUTING ACCEPT [1558:188540]
:OUTPUT ACCEPT [87:6458]
-A PREROUTING -i br1 -p tcp -m tcp -d --dport 2048:2248 -j DNAT --to-destination
-A PREROUTING -i br1 -p tcp -m tcp -d --dport 53 -j DNAT --to-destination
-A PREROUTING -i br1 -p udp -m udp -d --dport 53 -j DNAT --to-destination
-A PREROUTING -i br1 -p tcp -m tcp -d --dport 21 -j DNAT --to-destination
-A PREROUTING -i br1 -p tcp -m tcp -d --dport 22 -j DNAT --to-destination
-A PREROUTING -i br1 -p tcp -m tcp -d --dport 22 -j DNAT --to-destination
-A PREROUTING -i br1 -p tcp -m tcp -d --dport 22 -j DNAT --to-destination
share|improve this question
up vote 4 down vote accepted

Use source nat (SNAT) rules instead of MASQUERADE. This lets you control the source address, so you can do something like this:

iptables -t nat -A POSTROUTING -o br1 \
  -s -j SNAT --to-source

And so forth.

If you take a look at the iptables man page, you'll find the following in the description of the MASQUERADE option:

It should only be used with dynamically assigned IP (dialup) connections: if you have a static IP address, you should use the SNAT target.

share|improve this answer
Whoops, it looks like you deleted your comment. In any case: Is the SNAT rule for matching? That is, when you look at it, is the packet count increasing as packets attempt to go out? – larsks Aug 14 '12 at 22:35
Sorry. I realized that I probably need to edit the routing table on the gateway for the aliased IP. I haven't had time to play with it yet though. I'll look at it tomorrow. Thanks for your help with this. I think you pointed me in the right direction. – dan Aug 14 '12 at 23:46
It started working today... I changed "-A POSTROUTING -o br1 -j MASQUERADE" to "-A POSTGROUTING -o br1 -J SNAT --to-source" and added "-A POSTROUTING -o br1 -s -j SNAT --to-source" right above it and it works great. Thank you so much! – dan Aug 15 '12 at 17:32
I'm glad it helped! It would be nice if you could mark this answer as "accepted" by checking the checkmark to the left of the answer. – larsks Aug 15 '12 at 20:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.