Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have one notebook and two servers:

  • ip = (I have installed nginx here)
  • ip = (There is nothing here, but I can ping from here)

I open browser on my notebook, open 

and get web page from Nginx.

Now I want to do something so, if I will open 

in the browser this server forward my request and return me same page back.

I have connected to and make this changes:

root@6d2de436eef0:/# sysctl net.ipv4.ip_forward=1
net.ipv4.ip_forward = 1
root@6d2de436eef0:/# iptables -t nat -F PREROUTING
root@6d2de436eef0:/# iptables -t nat -A PREROUTING -d -j DNAT --to-destination 
root@6d2de436eef0:/# iptables -F FORWARD
root@6d2de436eef0:/# iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
root@6d2de436eef0:/# iptables -A FORWARD -m conntrack --ctstate NEW -d -j ACCEPT
root@6d2de436eef0:/# iptables -P FORWARD DROP

Now I open, 

but get nothing. Why and how can I fix it ?


Here is a result of tcpdump on -

Update 2

Sorry, I gave you not full information. Both servers and are docker containers. Here is ifconfig on the host machine:

$ ifconfig
docker0   Link encap:Ethernet  HWaddr fe:69:ac:53:70:53  
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::f0ee:53ff:feae:aa6c/64 Scope:Link
          RX packets:162525 errors:0 dropped:0 overruns:0 frame:0
          TX packets:278054 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:10471915 (10.4 MB)  TX bytes:436185034 (436.1 MB)

eth0      Link encap:Ethernet  HWaddr f0:de:f1:27:7a:e6  
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::f2de:f1ff:fe27:7ae6/64 Scope:Link
          RX packets:16023892 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4007904 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:8557520703 (8.5 GB)  TX bytes:484890281 (484.8 MB)
          Interrupt:20 Память:f8500000-f8520000 

eth1      Link encap:Ethernet  HWaddr 82:ea:96:9d:48:88  
          UP BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
share|improve this question
up vote 1 down vote accepted

A way to "forward" to could be to use an inetd server.

Then, you will be able to redirect to

On Server :

apt-get install xinetd

Edit /etc/xinetd.conf and add something likle this :

service my_redirector
 type = UNLISTED
 disable = no
 socket_type = stream
 protocol = tcp
 user = root
 wait = no
 port = 80
 redirect = 80
 log_type = FILE /tmp/somefile.log

Restart xinetd : service xinetd restart

Now, should redirect you at

No need of iptables anymore here.

share|improve this answer

You can't use DNAT if both servers are in the same network.

DNAT is for address translation (a.k.a. firewall), FORWARD is useless in this case because this packets doesn't pass through the server2.

You need a http proxy or load balancer.

Another options is setting a simple index.html in apache into the server2 and use redirect meta tag.

share|improve this answer
I agree on the high level solution, but out og curiosity: Wouldn't it be possible to use a pre-routing rule to edit the dest IP, allowing it to be sent to .2? – Jervelund Feb 18 '14 at 8:07
because isn't logic to route packets on two servers that belong to the same subnet. It's impossible to define routes, the routes exists to move packets between different networks. And NAT is basically a router that allow us to move packets from one network to another. The solution proposed is basically an awful trick. IMHO. OK, probably works but the nginx server only will see .3 as client in the access log – fbs Jun 28 '14 at 4:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.