Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I now played around with iptables (the whole day) to make my rules work, but there is one issue.. all traffic that I redirect goes through my server and back through my server. We are talking about high HIGH amounth of bandwidth. So I hoped there was a option to redirect a user to the external global IP, so it talkes to the external IP and the users IP directly.

I now did:

iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to-destination

iptables -t nat -A POSTROUTING -j MASQUERADE

*this is just a example, the real project is not port 25 and is also a other program (we work on...)

But now all traffic goes like this User>MyServer>ExternalServer>MyServer>User

but i hoped to get something like this: User>MyServer>ExternalServer>User

Simular to CNAME or maybe htacces redirect. Is something like this even possible?

share|improve this question
As often: why? What do you want to achieve? You're speaking of port 25/tcp - why don't you set your MX accordingly? Or configure your clients appropriately? – Michuelnik Aug 22 '12 at 8:28
Ok yes true, this was just a example, the real project is not port 25, but some other port and program. But for the example I thought it would not matter.. – klaas Aug 23 '12 at 9:27
It might matter. How are "MyServer" and "ExternalServer" correlated? Is the LVS approach of mgorven applicable? If not, then there is no possible way of achieving, what you want instead of protocol features. Like http's redirect. – Michuelnik Aug 23 '12 at 14:00

I think you want an xinetd redirect, not an iptables one (I've never needed to do this in anger). Try this:

# /etc/xinetd.d/redirect25
service redirect25
        port                    = 25
        type                    = UNLISTED
        disable                 = no
        socket_type             = stream
        wait                    = no
        user                    = root
        redirect                = 25

then restart xinetd. You might need to consider relay issues given that this is the mail port.

share|improve this answer
ok thx! I'll try this! but i did not succeed with xinetd last time because i use a port that is not used by any deamon.. (port 25 was a example but i use a other port on my real website) so I don't know if that caused the issue.. but i will try it again! thx – klaas Aug 21 '12 at 20:47
did you use UNLISTED? – Sirex Aug 21 '12 at 20:53
yes i used " type = UNLISTED " – klaas Aug 21 '12 at 20:55
also my iptables look like this: iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination – klaas Aug 21 '12 at 21:02
This still proxies all traffic. – mgorven Aug 22 '12 at 6:22

You probably need to use something like Linux Virtual Server with the LVS/TUN or LVS/DR methods. These create a virtual IP on a load balancer, which then tunnels or directly routes incoming packets to backend servers while preserving the original source and destination IP (unlike NAT). The backend servers can then route the response packets directly to the client and not via the load balancer.

I don't think that this can be done with iptables alone.

share|improve this answer
WO! Mgorven... you brought me on a good possible solution!! i need to read more ofcourse but the images in the example looks very promising. – klaas Aug 23 '12 at 9:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.