I have a xen machine (DomU) hosting a few VMs.

One of the VMs is called router ( and is the only one of the machines supposed to be reachable from the outside.

There are other VMs which are going to recieve traffic, but it has to be filtered. Let's call one of these machines web (, as it serves a webpage.

Packets coming to web follow this routing path:

xen DomU -> router -> web

DomU's configuration:

-A PREROUTING -d <external_ip> -p tcp -m tcp --dport 80 -j DNAT --to-destination 

router's configuration:

-A PREROUTING -d -p tcp -m tcp --dport 80 -j DNAT --to-destination 

Everything works as expected.

Port 80 from the external IP is routed via router all the way to web.

There is a problem tho:
web sees as the source for the connection, rather than the real client IP.

I guess this is caused by the fact that there are two DNATing iptables.

But why?


using MASQUERADE is for NATting a source address to a public IP; you should NOT masquerade traffic coming from the internet, which it seems you are likely doing.

Therefore, remove your MASQUERADE rules entirely or, if you need them to provide internet access to internal clients, restrict the MASQUERADE to a specific subnet

  • I've added changed the masquerade line to: -A POSTROUTING -o eth0 -s -j MASQUERADE so now it should only masquerdate traffic that should be routed from the internal subnet thru this machine. I thought -o eth0 was doing that, but the machine was routing all traffic thru eth0. Thanks :) – Prody Sep 12 '11 at 9:30

I believe the MASQUERADE statement on "router" is, uh, masquerading the external IP as it comes through "router".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.