I'm migrating servers, and I'd like to forward port 80 on my existing machine to port 80 on the new machine while DNS switches over.

I'm running Ubuntu 10.04 server and trying to follow the guide at http://www.simplehelp.net/2009/04/15/how-to-redirect-traffic-to-another-machine-in-linux/

I've run

# echo 1 >/proc/sys/net/ipv4/ip_forward

But when I run the next command I get an error:

#iptables -t nat -D PREROUTING -p tcp --dport 80 -j DNAT --to-destination
iptables: No chain/target/match by that name.

It seems I don't have the nat table there. Here's the output of iptables -L:

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

There's no nat table.

What do I need to do to forward it to the other machine?

Note: I know about rinetd, and I can even have the webserver proxy requests to the new server. I'm trying to do this so that the logs will still make sense (rather than having a ton of logs that say the source IP was the old server)

Edit: Thanks to Eduardo, the problem was that the tutorial mistakenly says "-D PREROUTING" which is the command to delete the rule, it should read "-A PREROUTING".

However it still doesn't work. Here's what I'm doing: machine-1: machine-2: I want to redirect machine-1 to machine-2. On machine-1 I've run:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination

On machine-2 I've run:

echo 1 > /proc/sys/net/ipv4/ip_forward #not sure if this is necessary, it didn't work at first so I ran this here too
iptables -t nat -A POSTROUTING -p tcp -d --dport 80 -j MASQUERADE

On my workstation, I try to wget expecting it to give the response from machine-2 (and that machine-2 will have my workstation's IP in its logs) - however I just get connection timed out. I've checked machine-2 and it responds correctly.


Try replacing -D PREROUTING with -A PREROUTING. You're trying to delete a rule that doesn't exist. The tutorial has this same error repeated several times, I see - just use -A everywhere.

Also, you can use iptables -nvL -t nat to see the NAT tables.

  • Thanks, I can add the rules now. Unfortunately it still doesn't work. Details in an edit to the question.
    – John Smith
    May 23 '11 at 19:30
  • @John, you should run the second rule (the MASQUERADE one) in the same machine that's doing the redirect. No rules are necessary in the destination one. May 23 '11 at 19:34
  • Thanks, that works. The logs show the request in server-2 as coming from server-1, I was hoping they would show it as coming from the client. Is that possible to do?
    – John Smith
    May 23 '11 at 19:48
  • Only if server-1 is the default route for server-2 - which I guess it isn't, or this setup would have worked without the MASQUERADE rule. Consider the alternative: installing a reverse proxy (apache, lighttpd, nginx will all do) on server-1. That way you can pass the requests to server-2 AND keep the original source information. Search "reverse proxy" + <preferred web server> and you'll get lots of information on how to do this. May 24 '11 at 0:37

Both of the iptables rules need to run on the old machine-1. No special rules should be required on the new machine-2.

To troubleshoot, look at the counters in the iptables -t nat -L -n -v output and use tcpdump as well to verify that the addresses are being translated correctly.

Using MASQUERADE can cause unexpected issues. It's not supposed to, but by experience I've found that using SNAT is much more reliable.

I would normally implement this using a little bash script like this:



echo 1 > /proc/sys/net/ipv4/ip_forward

# flush old nat rules
iptables -F -t nat

# destination is redirected to new server
iptables -t nat -A PREROUTING -p tcp --dport 80 -d $OLDIP -j DNAT --to $NEWIP

# source on the redirected packets should be us (the old server), and not original client
iptables -t nat -A POSTROUTING -p tcp --sport 80 -d $NEWIP -j SNAT --to $OLDIP

These rules could be a bit greedy though; it would be better to specify the interfaces using -i and -o if possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.