Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Linux box, I have create a GRE tunnel called gre1 172.17.1 -> 172.17.2. The Linux box IP is, the end point IP is

I am trying to do a source NAT (NOT destination NAT) to tunnel the traffic going from the Linux box to actually go to the tunnel is the destination port is 80. I have tried things along these lines without success:

iptables -t nat -A OUTPUT -p tcp --dport 80 -j SNAT --to
iptables -t nat -A FORWARD -p tcp --dport 80 -j SNAT --to

Most examples I found for GRE tunneling is for DNAT, not SNAT. Any example that would work for my case?

share|improve this question
up vote 2 down vote accepted

If I read your question correctly, you want port 80 traffic to go down your tunnel. This isn't done with SNAT, but with policy routing.

First we need to set up a new routing table:

# echo "2  tunnel" >> /etc/iproute2/rt_tables

Next we need to set up the routing table to send all traffic via the tunnel:

# ip route add default via dev gre1 table tunnel

Now we need to make some traffic use that routing table rather than the default routing table. This is done by marking the packets and then adding a rule to use the specified table for those marked packets:

# iptables -t mangle -A OUTPUT -p tcp --dport 80 -j MARK --mark 200
# ip rule add fwmark 200 table tunnel

Replace OUTPUT with FORWARD if you want traffic being forwarded being sent down the tunnel. This only works for locally generated traffic with OUTPUT.

You can find more information in the Linux Advanced Routing and Traffic Control (LARTC) guide.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.