Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Hello I am experiencing some issues with my iptables. Here's what I want to do:


Brackets are interface names and A, B and C are hosts. Now I would like to forward port number 80 of host C so that It would be accessed via host A.
host A is
host C is

I intentionally ACCEPTed all FILTER chain options as the default policy because I wanted to make sure that NAT is working properly first. I enabled ip_forward.

So here's what I have done:

sudo iptables -A PREROUTING -t nat -p tcp - d -j DNAT --to

However it is not working. What am I missing here?

share|improve this question

I don't think you need NAT at all in this case. You're not using NAT in its most frequent use case of proving network access to a large network from a single public IP. You should simply route the packets with the IP forwarding.

There shouldn't be any reason that NAT would be required for accessing C from A if a) IPv4 forwarding is turned on and b) your IPTables FORWARD chain is set to accept forwarded packets.

But if you insist, I'd suggest using SNAT:

iptables -A POSTROUTING -o eth2 -j SNAT --to-source (IP of Host B eth2)

Note for future readers: the eth2 reference is for the outgoing interface on the (center) NAT'ing computer when connections are being initiated and refers to the name of the same interface that the source IP is being set to.

share|improve this answer
should I add this on top of my rule on my question or just this command by itself? – Sarp Kaya Oct 7 '12 at 0:06
It should be used instead of your rule. That said, I really don't think you need NAT at all for routing between RFC1918 networks. It really just isn't necessary. If you're trying SECURE one network from another one while allowing web access, you need the stateful packet inspection aspect of a firewall NOT Network Address Translation. – Magellan Oct 7 '12 at 0:16
Well I know but this is sort of a homework. So I cannot do anything else... – Sarp Kaya Oct 7 '12 at 5:25
Be aware that homework questions are off-topic in Serverfault and likely to be closed at any time. – Magellan Oct 7 '12 at 15:23
up vote 1 down vote accepted

Well this is how I have done it:

iptables -A PREROUTING -t nat –p tcp -d –dport 80 -j DNAT –to-destination
iptables -A POSTROUTING -t nat –p tcp –d –-dport 80 -j SNAT --to-source
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.