Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Ubuntu machine running as a firewall. This machine has our static IP configured on eth1. It is connected to our network via eth0.

I have a new server running Server2012 with IIS installed. It is a sharepoint server. I need the sharepoint server to be accessible to the internet and the local network via a domain name. i.e. ""

What is the IPTables rule I need to make this happen?

Where I'm at:

I have a rule in the nat table to redirect incoming requests to our sharepoint server. It works OUTSIDE our building. When I try to access it from INSIDE our building, I get the apache server on our local firewall.

sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 10.100.XX.XX:80
sudo iptables -A FORWARD -i eth1 -p tcp --dport 80 -d 10.100.XX.XX -j ACCEPT
sudo iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to 10.100.XX.XX:443
sudo iptables -A FORWARD -i eth1 -p tcp --dport 443 -d 10.100.XX.XX -j ACCEPT

What am I missing here?

share|improve this question
Did you really obscure your RFC1918 addresses? That's rather pointless... – Michael Hampton Feb 14 '13 at 20:31
Sorry if it bothers you. I'm just a programmer who has been forced into some server admin stuff. Not sure what the rules are around here so it's better safe than sorry. – Jason Maggard Feb 14 '13 at 20:49
You don't have to obscure anything, as far as we care. In fact, it's almost always better if you don't. Only if you have sensitive information would you need to consider obscuring it, (like the name of your company) but RFC1918 addresses aren't, by definition. – Michael Hampton Feb 14 '13 at 20:58
up vote 1 down vote accepted

Your rules are only applied to packets entering on eth1 from the Internet, and so won't be applied to packets entering on eth0 from the LAN. Either add another set of rules specifying eth0, or remove that condition from the current rules:

iptables -t nat -A PREROUTING -d -p tcp --dport 80 -j DNAT --to 10.100.XX.XX:80
iptables -A FORWARD -p tcp --dport 80 -d 10.100.XX.XX -j ACCEPT
iptables -t nat -A PREROUTING -d -p tcp --dport 443 -j DNAT --to 10.100.XX.XX:443
iptables -A FORWARD -p tcp --dport 443 -d 10.100.XX.XX -j ACCEPT

If the SharePoint server is connected to eth0 you're going to run into the hairpin NAT problem. To address this you need to SNAT the outgoing packets if the source is the LAN subnet:

iptables -t nat -A POSTROUTING -p tcp --dport 80 -d 10.100.XX.XX -s 10.100.XX.0/24 -j MASQUERADE
iptables -t nat -A POSTROUTING -p tcp --dport 443 -d 10.100.XX.XX -s 10.100.XX.0/24 -j MASQUERADE
share|improve this answer
Thanks. Wouldn't the first set of commands redirect all traffic bound for Port 80 to my internal server? i.e. if a user is trying to reach Google he's going to wind up talking to my internal server. Just making sure, I already "broke the internet" once today, I'm trying not to do it twice. :) – Jason Maggard Feb 14 '13 at 20:46
@JasonMaggard Ah yes, you're correct. You should match the target IP specifically (edited). – mgorven Feb 14 '13 at 20:57
Thank you! That worked like a champ. – Jason Maggard Feb 14 '13 at 21:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.