Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top has external ip.

I have a debian server running BIND9, it contain some clients, I created the zone and I created A record to's ok, but I would know if I can point the A record to the real external ip, but route clients to localhost? So, when users access through the dns they will be on my server that supposedly has the original external ip, not the ip of my server.

(I'm looking for some iptables,host,ferm or script that do it, but it's hard to find)

share|improve this question
This question isn't entirely clear about what you are looking to do. You want to respond to a DNS query with an A record pointing to a specific IP, when someone tries to connect to that IP over the web, they are redirected to a different server. Is that correct? – NickW Mar 6 '13 at 16:43
Yes, its correct – Julio Mar 6 '13 at 17:31
Well, mircea answered it for you then. – NickW Mar 6 '13 at 17:32

If you want to impersonate a public server with a local one, in your local network you have 2 solutions:

  1. Use a local DNS that will answer with the private IP for local clients. For the external clients you can answer with the public IP. See:
  2. Use NetFilter (iptables) and create a DNAT rule and redirect the public IP towards the local one. Something like:

    iptables -A PREROUTING -t nat -p tcp --destination --destination-port 80 -m state -j DNAT --to-destination

share|improve this answer
what state i need to use? I tryed iptables -A PREROUTING -t nat -p tcp --destination external-ip --destination-port 80 -j DNAT --to-destination and iptables-save and tried to access , and it goes to real external-ip – Julio Mar 6 '13 at 17:30
Have you tested from an workstation? How is your firewall configured? – Mircea Vutcovici Mar 6 '13 at 19:03
What is the topology of your network? Have you added the rule on the Linux machine that is the default router of your network? – Mircea Vutcovici Mar 6 '13 at 19:05
You can use tcpdump and run it on both the internal interface and on the external interface. You can use -j LOG to log in syslog when the rule is matched. – Mircea Vutcovici Mar 6 '13 at 19:06
my configs.. MY DNS: THE DOMAIN: I CREATE THE ZONE > IN NS IN A ( the real external ip of ) - it's working --- I would like the clients of my dns access and when the client pc do the query for, return the ip, but be routed to localhost, i tried the Mircea awnswer but isn't working yet, i think i'm the right way – Julio Mar 6 '13 at 21:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.