So I have a machine with a single interface. It has 2 ip addresses (eth0:, eth0:1 I'd like to take any traffic coming in on and NAT it to an external ip address. As best I can tell I've done everything needed to make it work, but it doesn't so I'm missing something.

/proc/sys/net/ipv4/ip_forward is set to 1

my iptables are all set to default ACCEPT, here is my DNAT rule:

iptables -t nat -A PREROUTING -d -j DNAT --to-destination

The machine has a route to via a gateway reachable from eth0: UG 0 0 0 eth0

The DNAT rule doesn't seem to actually be doing any sort of NAT/redirection.

What have I missed?

  • For anyone else that runs across this, I was missing the corresponding SNAT rule. Once I put that in place, it worked like magic ;). iptables -t nat -A POSTROUTING -d -j SNAT --to-source – koyong Sep 19 '11 at 18:42

I'd do an iptables -t nat -L -v -n to see the counts on the DNAT rule in the PREROUTING chain. You can watch them increase with each new connection processed by the rule. If they're not being incremented then I'd start sniffing the traffic on the eth1 interface to see if the traffic is making it there.

It's likely that your FORWARD chain is set to a default drop policy and doesn't have a rule to forward this traffic. Double-check that, too.

  • All of my tables are definitely set to default allow, it seems as though iptables isn't liking my alias interface at all. I changed the NAT rule slightly so that instead of -d I was checking --dport 22 and the counts were moving, but it was also intercepting my traffic on the actual interface (which won't work). – koyong Sep 19 '11 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.