Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently setting up my server. I use proxmox which similar to vmware. Important thing to know is that i only have 1 external IP address. On my server, I forward port 80 and 443 to virtual host apache using this command :

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to

My network is also linked with :

iptables -t nat -D POSTROUTING -s '' -o eth0 -j MASQUERADE

Now the problem is that if I do redirect port 80 & 443 this way, apt-get throws 404 Error when i use it from a VM (behind my gate).

How can I redirect port to my VM by having still apt-get working ? What am I doing wrong ?


share|improve this question

migrated from Feb 14 '13 at 15:56

This question came from our site for professional and enthusiast programmers.

up vote 0 down vote accepted

You redirect ALL packets to port 80 and 443 to your guest, including its own packets. Add a

-i eth0 

condition to your DNAT rules.

share|improve this answer
I don't see why that shall be a problem. If e.g. tries to access the webserver then it will probably try to connect to the external address so this packet from eth1(?) must be DNATted to, too. – Hauke Laging Feb 14 '13 at 16:14

Can you check (with tcpdump) what happens on the webserver? I assume that such a rule is missing (assuming eth1 is your internal interface):

iptables -t nat -A PREROUTING -i eth1 -o eth1 -j SNAT --to $INTERNAL_GATEWAY_IP

Without this the client tries to connect to, the gateway deflects the packet to, the webserver sees a connection from the client (e.g. thus sends its reply to, and the client having sent to and getting a reply from just goes "WTF?"... But with SNAT the webserver responds to the gateway, the gateway rewrites both source and destination address and everyone's happy.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.