Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a firewall between 192.168.255.0 and 172.16.255.0. Both /24. 192.168.255.0 get DNAT'd to a proxy server @ 172.16.255.5:8080. I want this to continue however I have a web server 172.16.255.50 that I want direct connection to for testing. I've tried this statement, but iptables keeps erroring when trying to add it

iptables -I PREROUTING -i eth1 -d \! 172.16.255.50 -p tcp --dport 80 -j DNAT --to-destination 172.16.255.5:8080

Thanks!!

share|improve this question
    
This would work better, if you pasted the exact error you get... –  mulaz Aug 24 '12 at 21:02
add comment

1 Answer 1

up vote 1 down vote accepted

There are 2 issues here

  1. You left off -t nat, so its trying to add to the PREROUTING chain in the filter table, which doesn't exist.
  2. The 'not' (!) has to go before the -d.

Working solution:

iptables -t nat -I PREROUTING -i eth1 \! -d 172.16.255.50 -p tcp --dport 80 -j DNAT --to-destination 172.16.255.5:8080


Alternatively, another way of doing things like this is to put a rule in before that one which matches the exception traffic and does nothing with it. Iptables stops once it hits the first matching rule, so it never gets to the later rule.

iptables -t nat -A PREROUTING -i eth1 -d 172.16.255.50 -p tcp --dport 80
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination 172.16.255.5:8080
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.