Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2 servers. Server 1 with ip and server 2 with ip

My domain points to at the moment, but very soon I'm going to switch to ip I have already setup a low TTL for domain, but some people will still hit the old ip a after I change the ip address of the domain.

Now both machines run centos 5.8 with iptables and nginx as a webserver.

I want to forward all traffic that still hits server to so there won't be any downtime.

Now I found this tutorial: but I cannot seem to get it working.

I have enabled ip forwarding: echo "1" > /proc/sys/net/ipv4/ip_forward

After that I ran these 2 commands:

/sbin/iptables -t nat -A PREROUTING -s -p tcp --dport 80 -j DNAT --to-destination
/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE

But when I load in my browser, I still get the pages hosted on and not the content from What am I doing wrong?

share|improve this question
up vote 2 down vote accepted

Try changing -s to -d

You want to match the destination address and not the source address...

You also need to adjust your MASQUERADE-rule to include the interface the traffic takes on the way back. (Most likely eth0 or similar).

Do this with the -o flag. For example like this: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

share|improve this answer
Just tried that, but unfortunately no change :( – Mr.Boon Oct 27 '12 at 10:24
Hm, could the problem be that you haven't defined the out-interface in your MASQUERADE-rule? – miono Oct 27 '12 at 10:46
Thank you for your reply, but I'm not exactly sure what you mean. – Mr.Boon Oct 27 '12 at 10:55
I've added some information to my reply now @FunkyChicken. – miono Oct 27 '12 at 16:32

Are the two machines in the same subnet and can reach each other without going through other routers? If not, the method described won't work even if you set it up properly.

When doing such migrations, I often use rinetd to forward random TCP ports. Or Apache's mod_proxy, if you use Apache anyways (which you do not, but I do).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.