Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to configure my computer as a gateway between two networks, but I cannot make it working for some reasons

Here is a representation of the network: ...
        |            |              |
( ...)
     eth0:1        eth0:2         eth0:3
        |            |              |

My computer has N virtual interfaces (eth0:*) with their own IP addresses on the interface (eth0). I want that any connection (TCP mostly) that attack the eth0:* interfaces are forwarded to the equivalent** server.

I tryied using the redir executable but since servers use random port numbers for listening (cannot change this) I had to restart the processes everytime I made some tests.

So I used iptables rules like these (for only one server for testing):

iptables -t nat -A PREROUTING -d -j DNAT --to-destination
iptables -t nat -A POSTROUTING -d -j SNAT --to-source
iptables -A FORWARD -i -d -j ACCEPT

But any connection to returns "Connection refused" while any connection to is accepted.

Then I "played" with iptables rules without reseting the rules and I succeeded to connect to which was actualy the right server ; but when I tried another connection (with a temp web server on TCP/6666), the connection has been rejected like above.

Do you have a full exemple to make it work please ?

Note: I removed every entries in iptables to do other tests, so I restarting from scratch without what I did before...

@lain: I enabled IP forwarding

$ cat /proc/sys/net/ipv4/ip_forward
share|improve this question
Did you enable IPv4 forwarding? – Iain Mar 25 '14 at 14:49
my guess is that packets from 192.168.2.* are arriving at 192.168.1.* servers but they don't know how to reply back to the "2" network (no route, no forwarding). You can verify this by running tcpdump on a target server on the "1" network and checking if you see the requests and not the replies. – LinuxDevOps Mar 25 '14 at 15:52
Interfaces aliases are deprecated on Linux, stop using them. – BatchyX Mar 25 '14 at 16:16

iptables has a match that suits you: It's called NETMAP.

iptables -t nat -A PREROUTING -i eth0 --src -j NETMAP --to
iptables -t nat -A PREROUTING -i eth1 --src -j NETMAP --to

As for your interface aliases, ditch them. Not only are interface aliases deprecated (if you use ip addr, you will see that the kernel mapped them to its native functionality of having several addresses by interface), but it seems overkill here, as no local service uses them.

If you this host to answer ARP requests for those ip in eth0, use the ARP proxy feature or add a local route telling the kernel that all those IP are its own:

ip route add local dev eth0
share|improve this answer
I like this answer, thank you ;) The thing is that the networks are 10.100.XX.YY/16 (instead of 192.168.2.xx) and the other one is 10.200.0-3.XX/22 (instead of 192.168.1.xx) ; Your solution does not work because I'm trying to "bind" 10.100.100-103.YY/16 to the coresponding 10.200.0-3.XX/22, do you think it's possible ? – Zaghp Jul 21 '14 at 13:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.