Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a dedicated machine which has 2 VMs running. Host A (Router):


and I have

Host B(Application Server)

My IPTables config is:

modprobe iptable_nat
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -j ACCEPT
iptables -A FORWARD -i eth2 -j ACCEPT

and an example firewall forward I use would be

iptables -t nat -A PREROUTING -p tcp -i eth0 -d --dport 25565 -j DNAT --to

in all of my logs for applications they say all requests are coming from my external IP

What can I do to make it so that packets show the original source address and not

share|improve this question

closed as too localized by Ward, MadHatter, Michael Hampton, Jenny D, Chris S May 20 '13 at 13:43

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

If you don't want NAT, why are you using NAT? – Michael Hampton May 20 '13 at 2:41
I have multiple VMs behind one IP address. What else would I do instead of NAT? – Jamie H May 20 '13 at 2:42
He's asking because what you're describing as a problem is actually the main purpose of source NAT: To allow multiple hosts to share a public IP. Do you have multiple public IPs assigned to your router? – May 20 '13 at 2:45
I only have the 1 IP on my router. It would cost me quite a bit more to add another address so I'm trying to share the one address with multiple hosts. I want mutiple hosts to be able to share one public IP but if I have a web server running it shows all of the traffic coming from the external IP not the IP of the client. – Jamie H May 20 '13 at 2:55
Put the web server on the 10. net. – dmourati May 20 '13 at 5:28

What you need to do is to remove the NAT and instead do port forwarding to proxy servers for each port that you are serving.

The proxy servers then send the requests to the appropriate servers for the domain specified in the request. For example, for port 80, set up Apache2 as a reverse proxy as explained in this IBM article.

For email set up a relay host. For other services you will need to find appropriate proxies.

share|improve this answer
Not very useful as there are quote a few different applications which don't won't be supported by a proxy. – Jamie H May 20 '13 at 14:14
@JamieH: Can you list the applications? – Jonathan Ben-Avraham May 20 '13 at 14:20
Things like Minecraft, Game Servers and that kind of stuff. I already have Nginx proxying things like Web Servers. – Jamie H May 20 '13 at 18:03
@JamieH: Your OP NAT rule, implies that you have only one server per application. If that is the case, you can just use iptables to port forward directly to the appropriate server without using NAT or a proxy. If you have multiple Minecraft type servers, then your only option is to use both direct port forwarding and port separation on the client side. That is to tell the clients to connect to your external IP address but to use different ports depending on which server they want to use. In any event, In any event, I upvoted the question because a lot of sys admins at smaller orgs have same Q. – Jonathan Ben-Avraham May 20 '13 at 18:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.