Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I built a server(S) with openvpn.
And there might be several vpn clients(C1~C10) providing SSH/FTP/HTTP behind "S"
Several users(U1~U10) on internet will login through 'S' to access their own machine (C1~C10).

Assume that the U3 ip is
the S ip is
the C3 vpn ip is
and the forwarding port is '55555'

If a user(U3) types the correct user/pwd
--> 'S' will query which client(C3) belongs to the user and get its IP,
then DYNAMICALLY portforward the user(U3) to his client(C3) with:

//(only the can access  
iptables -t nat -I PREROUTING -i eth0 -s -p tcp --dport 55555 -j DNAT --to-destination

It's success so far.

But after the user logout, I delete this rule with

iptables -t nat -D PREROUTING -i eth0 -s -p tcp --dport 55555 -j DNAT --to-destination

This rule no more exist in 'iptables -t nat -L -n',
but the user U3 can still directly access C3 with

That rule keep working even I type the following and reboot.

iptables -t -nat -F

Help! Could anyone tell me what's wrong or is there a better way

I've found what the problem is.

I test what above with HTTP, but there is a proxy server at 'U3' side.

That is, what you see is old data cached by proxy.

Try other protocols, such as SSH or NC, the the result is correct.

But... that means this iptables mechanism may not work well if a user use proxy,

How could I solve this problem?

share|improve this question

migrated from Sep 27 '12 at 13:20

This question came from our site for professional and enthusiast programmers.

But... that means this iptables mechanism may not work well if a user use proxy. How could I solve this problem?

You can serve content with Cache-Control: no-cache, no-store and hope that the proxy respects this.

RFC 2616 Fielding, et al.

share|improve this answer
thanks a lot. I will try it – Smith.Lai Sep 28 '12 at 6:13
I've set this but with no luck. And I'm encountering another problem, would you mind having a look at this…? – Smith.Lai Sep 28 '12 at 7:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.