Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
I would like to port forward all that enter to 10.32.43.75:80 to 10.48.5.66:80
how can I do this with iptables in 10.32.43.75?
I tried this, but didnt work:
iptables -A PREROUTING -t nat -i ens33 -p tcp --dport -j DNAT --to 10.48.5.66:80
iptables -A FORWARD -p tcp -d 10.48.5.66 --dport 80 -j ACCEPT
asked Nov 3, 2021 at 15:03
The problem in your setup is that packet's source addresses remain the same. An example of the packet flow, where client is 192.168.100.100:
- Client's packet with source 192.168.100.100 arrives to 10.32.43.75 port 80. Packet's source address is 192.168.100.100 and destination 10.32.43.75.
- IPTables does destination NAT, changing destination to 10.48.5.66.
Packet's source address is 192.168.100.100 and destination 10.48.5.66.
- Packet is forwarded to 10.48.5.66. It sends a response packet to 192.168.100.100.
Response packet's source address is 10.48.5.66 and destination address 192.168.100.100.
- Response packet reaches the client. However, since the original packet was sent to 10.32.43.75, the source address 10.48.5.66 does not match client's expectations, therefore the packet is dropped.
The solution is to add
MASQUERADE rule, which changes source IP address to
10.32.43.75 on port forwarded packets:
iptables -t nat -A POSTROUTING -d 10.48.5.66 -p tcp --dport 80 -j MASQUERADE
answered Nov 5, 2021 at 8:15
Tero KilkanenTero Kilkanen
36.4k33 gold badges4040 silver badges6262 bronze badges