Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an OpenWRT router with 1 WAN port and many LAN ports.

I have assigned a second IP to the WAN port by adding a command to the startup scripts like that:

ip addr add X.Y.Z.G/24 dev eth0.2

Before that I have removed the bridge that is added to the WAN port so br-wan is gone.

I also added the following commands to forward connections coming to this second IP and port 80 to a machine on LAN.

iptables -t nat -I POSTROUTING 1 -p all -s -j SNAT --to X.Y.Z.G
iptables -t nat -A PREROUTING -p tcp -d X.Y.Z.G --dport 80 -j DNAT --to-destination
iptables -I FORWARD -p tcp -d --dport 80 -j ACCEPT

This way I have 2 web servers each one mapped to a separate public IP.

The problem I have is that with this setup the clients inside the LAN cannot access IP X.Y.Z.G:80 for some reason. Everybody else on the web is able to. So far my knowledge around iptables tells me that the last rule should allow forwarding connections to the internal IP from everywhere.

share|improve this question
It is allowing connections for everyone, but your second machine is trying to access it using it's public IP. You need to re-route traffic coming from the inside, to the same internal IP. Your second option is to use another resolve from the inside, so that it resolves to the internal IP. However, this requires more maintenance. – jishi Jan 4 '13 at 13:56
Ok so what commands can I add so a computer on the LAN that will normally use the other public IP to access the internet can have a rerouting again so when the traffic goes out of the first IP it will be accepted from the second IP? I thought with the current rules iptables would be doing this without problem. As a matter of fact these exact commands were used on a DD-WRT installation and they worked. But now I moved to OpenWRT and I am hitting this problem. – flipm0de Jan 5 '13 at 21:32
To start with, you are only allowing which is unnecessary I think, what you need to allow is X.Y.Z.G on the internal interface. It's been a long time since I worked with IPTABLES. – jishi Jan 6 '13 at 15:01
These are all the rules that I added to forward the X.Y.Z.G:80 to and to mark all the traffic going out of as going out of X.Y.Z.G. The rest are the standard OpenWRT settings + rules. – flipm0de Jan 6 '13 at 21:42
up vote 0 down vote accepted

After looking at what else OpenWRT does to forward normally ports and looking at the firewall status (Status->Firewall from the menu) which included the current iptables rules, I replicated some of the rules and it turned out that the magic happened :).

iptables -t nat -A POSTROUTING -p tcp -s -d --dport 80 -j SNAT --to

Turned out I have to explicitly add an SNAT rule from the internal network in order to get everything to work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.