Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have one "server A" that has multiple IPs attached to it, like so:


I have another "server B" that also has multiple IPs attached to it, like so:


Now, I want to setup iptables on "Server A" to forward/NAT all incomming traffic on "eth0:2" to IP on "Server B".

I have verified that "Server A" is able to "talk" to "Server B" on IP Ping and telnet to open ports works just fine and I have the forward-flag turned on (net.ipv4.ip_forward=1)

I have tried multiple different ways, DNAT, SNAT, MASQUERADE etc, but I cannot get anything to work.

This line works fine if I try to forward traffic between IPs on the SAME server:

iptables -t nat -A PREROUTING -d -j DNAT --to-destination

But if I switch out the "" for "", it does not work.

I assume that I need a second iptable rule to solve it. I have tried with the following POSTROUTING rules without any luck (not at the same time):

iptables -t nat -A POSTROUTING -d -j MASQUERADE
iptables -t nat -A POSTROUTING -d -j SNAT --to
iptables -t nat -A POSTROUTING -j MASQUERADE

What am I missing?


I finally got it to work by using the following:


iptables -t nat -A PREROUTING -d -j DNAT --to-destination
iptables -t nat -A POSTROUTING -d -j SNAT --to

However, now another problem appeared. All logs etc on server shows that ALL traffic now comes from, like apache logs, mail logs etc. I assume this is the nature of NAT.

However, when I do standard port forwarding on my home-router to my laptop that is running apache, I see the original "requester IP" in the logs. So, how does the router do this? And how can I do the same on my server setup?

Bottom line, I want to forward all traffic from Server A ( to Server B (, BUT I also want to be able to see where the traffic came from on Server B (, i.e the apache logs should show the original IP of the requester.

I assume I should use some other way than NAT to make this happen, and it should be possible, as even my simple home-router is able to do this.

One extra thing, the IPs attached to Server A and Server B is LOCKED to each respective server. Thus, Server A is NOT able to send out traffic FROM IP It is locked by my provider in the router.

share|improve this question
Can you ping with a source address of This looks like a connectivity issue; your rules are right. Also, it's better to use example subnets when redacting addresses:,, and –  Falcon Momot Jul 15 '13 at 4:18
I have updated my question. Could you please check it again? –  Daniele Testa Jul 16 '13 at 14:53
add comment

1 Answer

Since you want your server to behave as a router, you need to check a few things :

First, packet forwarding must be enabled in the kernel (by default it is not) :

echo "1" > /proc/sys/net/ipv4/ip_forward

You also need to make sure that iptables allows forward traffic (look at your FORWARD chain).

This and the DNAT rule should be enough to get packet flowing in one direction. However, if you need a TCP flow, you also have to make sure that you also have the SNAT rules you mentionned (otherwise, the remote host will think there is a problem since a server at is replying to the packet he sent as

Btw, for performance reasons, it is better to use SNAT in place of MASQUERADE if you have static IP.

share|improve this answer
As I mentioned in my post, I already have ip_forward=1. My FORWARD chain has a default-rule set to ACCEPT. –  Daniele Testa Jul 15 '13 at 3:14
Hum, I must have read you a little too quickly. Can you post relevant tcpdump output with the two rules in place ? Do both the counters increment correctly ? –  eltrai Jul 15 '13 at 9:04
As far as I know, if the packets was generated by the host himself - there is no need to enable ip forwarding at all. And you will need to use OUTPUT chain instead of PREROUTING –  ALex_hha Jul 15 '13 at 16:09
I have updated my question. Could you please check it again? –  Daniele Testa Jul 16 '13 at 14:52
I think it is not possible, because you are using SNAT and there is no way to get original source ip on the without additional software. On your home router you have used only DNAT, that's why you saw original ip. You could try to use reverse proxy for example nginx to still able get original ip address. What type of application is running on –  ALex_hha Jul 16 '13 at 15:17
show 2 more comments

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.