I am trying to use iptables to redirect outbound traffic to an external ip address as if it were inbound traffic. My setup is as follows;

         NET A          NET B      
|------|       |------|       |--|
|SERVER|<----->|DD-WRT|<----->|FW|<--> WAN
|------|   |   |------|       |--|
|------|   |
| COMP |<--|

Where SERVER and COMP are both computers on network A, and DD-WRT is a router connecting networks A and B, and FW is a large firewall connecting network B to the WAN.

I have port forwards set up properly on my DD-WRT router and the large Firewall to forward packets to SERVER when external computers attempt to connect to FW. However, when COMP attempts to connect to FW, the packets are dropped because FW does not recognize that packets coming internally destined for the WAN address are meant to be routed according to the external rules.

Therefore, I would like to somehow route the packets emanating from COMP destined for FW's WAN address to appear to the DD-WRT as if they are instead destined for it's Network B address, as I know it is capable of routing these types of packets properly.

If anyone else has a better suggestion, I would of course be glad to hear it!


I'm guessing that you're doing NAT for traffic from NET A to NET B, in which case you'll need to add a rule to exclude traffic from NET A destined for the NET B address of the DD-WRT - something like:

iptables -t nat -I POSTROUTING -s <net.a.ip.block/mask> -d <dd-wrt.net.b.address> -j ACCEPT

or you could do a rewrite of the address like so:

iptables -t nat -I PREROUTING -s <net.a.ip.block/mask> -d <dd-wrt.net.b.address> -j DNAT --to <SERVER.net.a.address>

EDIT: Rereading the question properly you'll need a variant of the second method:

iptables -t nat -I PREROUTING -s <net.a.ip.block/mask> -d <fw.wan.add.ress> -j DNAT --to <server.net.a.address>
  • That is very close to what I want, however, I want the packets to be processed by the port forwarding rules I have setup already for incoming traffic. I realize that I can mirror the port forwarding rules in the iptables ruleset, however it seems to me it would be better to have it all in one place. Is there a way to forward the traffic, instead of to "server.net.a.address", to "dd-wrt.net.b.address" so that the packets are processed properly? Thank you for your response! – staticfloat Jun 22 '10 at 7:43
  • Probably the port forwarding rules are the iptables ruleset - but I'm a little unclear on one point - is the port forwarding on the FW, the DD-WRT or both? To do exactly what you requested in the comment just replace server.net.a.address with dd-wrt.net.b.address in the last iptables line. – Whisk Jun 22 '10 at 9:23
  • Hmmm, that doesn't seem to work, unfortunately. I see now, by further inspecting the current iptables config that you are absolutely correct, the webgui port forwarding rules are just iptables rules. :) I will just manually shadow the inbound rules. Thank you for your help! – staticfloat Jun 22 '10 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.