Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a webserver hidden behind a firewall. A DNAT rule on my firewall makes it reachable for visitors from the internet. The rule works for traffic from the internet. Unfortunately it doesn't work (or only in parts) for traffic coming from the same subnet as the real destination. For some reason netfilter doesn't restore the orginal destination address and therefore the client/sender disregards the answer packet.

What am I doing wrong?

Network Layout  # LOCAL Lan  # Client  # Server # firewall   # firewall (Not the real IP)

      | |
              |       |
      |   Firewall    |
              |       |
      | |
    |                     |
  (Client)            (Server)

iptables Rules

-t nat -A PREROUTING -d --dport 81 -j DNAT destination
-t nat -A POSTROUTING -s ! -d -j MASQUERADE (Should be irrelevant)

Szenario not working

(Client) trying to reach (Server)

tcpdump on firewall > Flags [S], seq 1884612678 > Flags [S], seq 1884612678 > Flags [S], seq 1884612678 > Flags [S], seq 1884612678
(Seems okay. tcpdump was on -i any. Incoming packet to orginal destination 144.xx Outgoing packet to new destination. But for some reason we're not seeing the responses)

tcpdump on destination (server)

IP > Flags [S], seq 4243879528,
IP > Flags [S.], seq 595099059, ack 4243879529,
IP > Flags [R], seq 4243879529, win 0, length 0
(Seems good)

tcpdump on source (client)

IP > Flags [S], seq 4243879528
IP > Flags [S.], seq 595099059, ack 4243879529, (WTF packet. The source should be 144.x again. For some reason netfilter didn't restore the orignal destination address for the response packet.)
IP > Flags [R], seq 4243879529
share|improve this question

You don't see any response packet on the firewall, because there is none. The server does not send the response to the firewall, because the client is in the same subnet.

Request: Client -> Firewall -> Server

Reply: Server -> Client

Therefore the client discards the response, because it does not expect any response from the server, but from the firewall.

Either try some crazy routing magic or set the internal IP for your URL in the client's hosts file. Or get rid of NAT at all...

share|improve this answer
As mentioned, NAT is horrible; this is an ugly hack at best. One way to make this work is to SNAT the traffic from the internal hosts so the webserver sees the firewall's address as the source address for the requests. iptables -t nat -A POSTROUTING -s -d -p tcp --dport 81 -j SNAT --to – fukawi2 Nov 24 '13 at 0:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.