Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a firewall between and Both /24. get DNAT'd to a proxy server @ I want this to continue however I have a web server that I want direct connection to for testing. I've tried this statement, but iptables keeps erroring when trying to add it

iptables -I PREROUTING -i eth1 -d \! -p tcp --dport 80 -j DNAT --to-destination


share|improve this question
This would work better, if you pasted the exact error you get... – mulaz Aug 24 '12 at 21:02
up vote 1 down vote accepted

There are 2 issues here

  1. You left off -t nat, so its trying to add to the PREROUTING chain in the filter table, which doesn't exist.
  2. The 'not' (!) has to go before the -d.

Working solution:

iptables -t nat -I PREROUTING -i eth1 \! -d -p tcp --dport 80 -j DNAT --to-destination

Alternatively, another way of doing things like this is to put a rule in before that one which matches the exception traffic and does nothing with it. Iptables stops once it hits the first matching rule, so it never gets to the later rule.

iptables -t nat -A PREROUTING -i eth1 -d -p tcp --dport 80
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to-destination
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.