I want to redirect all the incoming requests to an URL instead of an IP address how can i archive this.. And when I redirect using IP address the redirection is happening but the redirected IP/URL is not shown in the browser address bar.. how to change this?..

The following are the rules i'm setting,

echo "1" > /proc/sys/net/ipv4/ip_forward
ebtables -t nat -N GUEST
ebtables -t nat -A PREROUTING -i eth0 -j GUEST
ebtables -t nat -N GUEST-REDIRECT
ebtables -t nat -A GUEST-REDIRECT -j mark --mark-set 1 --mark-target CONTINUE
ebtables -t nat -A GUEST-REDIRECT -j redirect
ebtables -t nat -A GUEST -p 0x800 --pkttype-type otherhost --ip-proto 6 --ip-dport 80 -j GUEST-REDIRECT
iptables -t nat -A PREROUTING -p tcp -m mark --mark 1 -j DNAT --to-destination
iptables -t nat -A POSTROUTING -j MASQUERADE
  1. The clients are redirected to the IP but what i want is to redirect the request to a URL[ example: www.facebook.com/user ].

  2. When I use the above rules the clients are redirected to the IP but in the address bar of the browser its still showing the requested URL not the redirected one.

  • 4
    This question makes no sense - you can't convert a URL into an IP address. Turning lead into gold is simpler since they're both elements. Perhaps if you gave an example of what you're trying to achieve (input and output) then you might get a sensible answer.
    – symcbean
    Jul 26, 2012 at 12:39

3 Answers 3


If you want the redirected IP/URL to be shown in the browser, you need to send HTTP redirect response to the browser (like 301). Then, the browser will send another request to the new location.

This can not be done using iptables. This needs to be done using any HTTP server/load balancer/proxy.

  • how do i check that my machine is already having HTTP server/load balancer/proxy or not?.. Jul 26, 2012 at 13:03

You can't do this with iptables. You're confusing layers in the networking stack: IP is layer 3 in the OSI model, HTTP is layer 7. See http://en.wikipedia.org/wiki/OSI_model

If you want to redirect URL requests you could use Apache together with mod_proxy.

  • 1
    But it would be really cool if someone could write an "httptables" module for the Linux kernel! Jul 26, 2012 at 12:29
  • but shall I achieve this by redirect to some other port[say 8080] and execute a program on the redirected port[8080] to redirect?.. Jul 26, 2012 at 12:37
  • @symcbean and I are both unsure what you're trying to do. Please update your question. Jul 26, 2012 at 12:51

I guess you need to redirect incoming connections to a certain port which a web instance, such as Nginx, listens. Then Nginx has to redirect them to your URL.

# Redirect inbound TCP connections, destined to port 80, to port 4444
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination

Nginx config:

server {

  return 301 "http://example.com/notice/";

The only reason I can imagine why you should do this, instead of making Nginx listen port 80 directly, is that this solution helps make Nginx instance hot-pluggable, that is, you can make another Nginx instance (say /usr/local/nginx/bin/nginx) and listen on port 80, without actually modifying the existing one's configuration (more specifically /etc/nginx/sites-enabled/*) in order to replace the existing Nginx instance (say /usr/sbin/nginx).

  • The MASQUERADE target is counter-productive unless the connection needs to continue against its natural routing direction (such as out of the NIC it came from). Using MASQUERADE will deprive your web server from knowing the client's IP which can be quite detrimental. In this case, just the single DNAT will do the trick. Perhaps change -A to -I to fix any firewall issues.
    – Zdenek
    May 19, 2019 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.