Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a with X.X.Y.Y ip i want to forward traffic from port 80 to the domain(, I used the following iptable:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination X.X.Y.Y:80

but i dont get good result because X.X.Y.Y content is not equal to the domain(
For ex: if you go to ip of serverfault) with your browser you will see that result and content of the address(ip address) is not equl
I want to use domain in the above iptables rule, for ex:--to-destination just an example and i know its not working), how can i do this?
Is there any alternative way to do that without using iptables?
Thank you

share|improve this question
This doesn't make a lot of sense. What are you really attempting to do? – Michael Hampton Sep 3 '13 at 8:54
I want to send all the traffic from my server to another(that it's for mine) – Carig Sep 3 '13 at 8:56
You already said that. But you are missing a lot of detail. Please describe your entire setup from beginning to end. – Michael Hampton Sep 3 '13 at 8:57
"--to-destination (its just an example and i know its not working)" it's working, but if has multiple A records or dynamic ip address it would work "strange". iptables will resolve ip address of during startup and will use these ip address until restart. – ALex_hha Sep 3 '13 at 9:07
iptables v1.4.2: Bad IP address `' – Carig Sep 3 '13 at 9:13
up vote 2 down vote accepted

I think what you need is an HTTP proxy to do the rewriting of the request headers. IPTables doesn't parse the HTTP header and replace the domains in them.

You should look at something like Nginx, or Squid for doing that, just something that understands and rewrites the HTTP request headers into the domain that you want.

IPTables does not know any higher protocols than TCP or UDP.

share|improve this answer
very nice answer, so i have an alternative and i can use Http proxy like Squid proxy instead of iptables, that's right? – Carig Sep 3 '13 at 9:27
Yes. For rewriting the content of the HTTP headers you will have to use a proxy that is able to parse HTTP. IPTables cannot do that – mauro.stettler Sep 3 '13 at 9:28

You cannot do it with iptables even if you use the -d option as the domain names are loaded during iptables startup. The right way to do what you want to do is to use a proxy server like Squid.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.