Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with a LAN facing address of (eth0) and another LAN facing address of (eth1).

On this server I have a Virtualbox instance of fedora running an apache webserver (on port 8080) with a bridged interface to eth1 on the host server with address of

Users on the 192.168.6.x network can access the Webserver on the Vbox instance ( with no problems.

My question is what kind of iptables entries or commands should be made/executed so as to allow for users on the 192.168.5.x network to access the webserver on the vbox instance. (I'm hoping their url can be something like:

share|improve this question

There are only a few options in this instance: 1) Allow direct routing of hosts on the 192.168.5.x network to the 192.168.6.x network. (i.e a route to your network through your intermediate host and ip forwarding enabled in the kernel.

2) Port forward 8080 to the correct ip and port (check out balance-ng and run it on the eth0 interface)

3) iptables based port forwarding / nat

/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 -d --dport 8080 -j DNAT --to
/sbin/iptables -A FORWARD -p tcp -i eth0 -d --dport 80 -j ACCEPT

enable ip forwarding echo 1 > /proc/sys/net/ipv4/ip_forward

share|improve this answer
@Matty: I've tried this, and it doesn't seem to work. Should there be a postrouting rule that handles packets coming from the webserver to the clients on the 192.168.5.x n/w ? – Darider Nov 3 '09 at 23:39
like.... /sbin/iptables -t nat -A POSTROUTING -p tcp -o eth0 -s --to-source I'm not sure that would be necessary. But if you have no other rules, and you aren't using conntrack then it might be. You can also add state tracking. /sbin/iptables -A FORWARD -p tcp -i eth0 -d --dport 80 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT /sbin/iptables -A FORWARD -p tcp -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT – MattyB Nov 4 '09 at 0:07
The problem is the packets reaching the web-server have an ip of the 192.168.5.x domain, the webserver doesn't do anything with them doesn't even provide a response. Is there some kind of masquarding rule that can be applied such that the packets get the secondary ip of the main server (eg: – Darider Nov 4 '09 at 2:51
Does the virtual box not have a route to the 192.168.5 network through the intermediate host? It needs a route through the local host operating system since its doing the routing. – MattyB Nov 4 '09 at 4:11
the vbox instance is on the 192.168.6.x n/w is doesn't know about routing to 192.168.5.x n/w i was hoping iptable rules would do all the necessary packet munging. is there something i can do to fix this issue? – Darider Nov 4 '09 at 7:44

For me, the following worked:

sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sbin/iptables -t nat -A PREROUTING -p tcp -i eth0  --dport 80 -j DNAT --to

using virtualbox 3.2.12 on ubuntu 10.04 host. What the other answers did not mention is the masquerading, which in my understanding is nessessary to get the answer pakets out correctly.

share|improve this answer

This should forward requests on port 8080 on interface eth0 to on interface eth1 on port 8080.

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 8080 --to-destination -j DNAT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.