i have a small network, with one valid IP and a firewall with 3 network interfaces (LAN, WAN, DMZ).

  • I want to enable PAT on this valid IP to redirect http traffic to a server in my DMZ. (done)
  • I want to enable MASQ on this ip from traffic that comes from my LAN (done)
  • I want from my LAN as well to access my http server at DMZ. (partially)


in the above scenario, i cannot from my LAN, to access my http server in the DMZ, since it has the IP used by the MASQ (the only valid ip that i have). What would be the best option to solve this problem?

network interfaces:

  • eth0 (WAN)
  • eth1 (DMZ)
  • eth2 (LAN)

    /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

    /sbin/iptables -A FORWARD --o eth1 -d -p tcp --dport 80 -j ACCEPT

    /sbin/iptables -t nat -A PREROUTING -i eth0 -d -p tcp --dport 80 -j DNAT --to

    /sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

    /sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

    /sbin/iptables -A FORWARD -i eth2 -o eth0 -j ACCEPT

  • You probably did points 1 and 2 wrong. Without seeing your firewall rules, it is hard to say what is wrong and what you should to do get the third correctly.
    – Juliano
    Mar 4, 2011 at 17:07
  • if i have the ip assigned to my WAN interface, i do a PAT to any to redirect to my server at DMZ ( it works. if i want to surf from my LAN using MASQ it works. what doesn't work is from my LAN if i try to access Maybe because it's the same IP used for my MASQ?
    – VP.
    Mar 4, 2011 at 17:29
  • What Juliano said. It's all very well trying to anonymise this, but it's difficult to diagnose without more data. Feel free to anonymise your public ip address, by all means, but could we see the rest of your addressing scheme and firewall rules?
    – MadHatter
    Mar 4, 2011 at 17:38

3 Answers 3


I'm a bit confused with your explanation. So I'll just use a sample scenario here:

  • eth0 = WAN =
  • eth1 = DMZ =
  • eth2 = LAN =

And the webserver is given

# First, allow LAN & DMZ to access the outside world
# Now, allow outside access to the webserver
-t nat -A PREROUTING -i eth0 -d -p tcp --dport 80 -j DNAT --to
# Finally, allow forwarding
-A FORWARD -d -p tcp --dport 80 -j ACCEPT
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -i eth2 -j ACCEPT

If you need more security, feel free to expand the last two lines above, e.g.:

-N eth1_fwd
-N eth2_fwd
-A FORWARD -i eth1 -g eth1_fwd
-A FORWARD -i eth2 -g eth2_fwd
-A eth1_fwd -s ...... -j ACCEPT
-A eth2_fwd -s ...... -j ACCEPT

Hope this helps. Don't forget to add a default route toward the default gateway of eth0 :)

edit: oops, wrong ifaces on the later rules


Sounds like you are just having the standard hairpin NAT issue.

A common solution to the problem is to give your host in the DMZ an a private IP, on a different subnet, and setup split DNS. You server the private address to the internal hosts, and the external hosts will get the public address. You then have firewall rules to permit internal clients to the private DMZ subnet, and you have a NAT, and rule to forward from the address/port from to the web server in your DMZ.

  • It should be possible to do the hairpin NAT with iptables, I just rarely deal with it that way since I usually already have a split DNS since I don't want internal stuff leaking to the outside.
    – Zoredache
    Mar 4, 2011 at 18:55
  • so as i understood, here i would use routing to reach my DMZ and not NAT, right? The problem is that, without NAT, if my DMZ get compromised then it's possible to reach my LAN (even with fw rules). with NAT i have a better security.
    – VP.
    Mar 5, 2011 at 10:52

As an example of a problem that could be caused by topology - if your internal networks DMZ and LAN are using overlapping subnets, then this could cause the problem you are seeing because the LAN machine would not send packets destined for the DMZ machine to the firewall/default route (since it would think the DMZ machine is local).

That said, you said that browsing from your LAN to is not working. That makes sense because your DNAT rule is restricted to packets that come in eth0 (the -i eth0), so it won't DNAT packets coming from eth2 and headed to I don't see a good reason to restrict that PREROUTING rule to a specific ethernet interface.

Does hitting work from the LAN host?

  • no since my LAN ist and there is no routing to reach the
    – VP.
    Mar 5, 2011 at 10:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .