I was able to forward 80 port from my primary server to the second one with IPTABLES

The primary server has a public address X.X.X.X

so I forwarded X.X.X.X:80 ->

My problem is that the second server consider that all traffic coming from Internet is from (all remote addresses are and not the real address of clients exp: will show instead of the client IP )

Is there somebody who faced this problem? I need to fix it without using a reverse proxy solution

This is how I forward my packets:

iptables -A PREROUTING -t nat -d X.X.X.X -p tcp --dport 80 -j DNAT --to-destination

iptables -t nat -A POSTROUTING -d -p tcp --dport 80 -j SNAT --to X.X.X.X


2 Answers 2

  1. It looks like it is coming from the first router as it SNAT-ted. So remove the SNAT rule to keep the original source IP address of incoming traffic.
  2. Then, tell the second server that its default router should be the first server which knows how to route it back to the source.

I assume that all the other things are configured properly:

  • IP forwarding enabled
  • no other blocking iptables rules

From my understanding, your primary server has two fixed ip addresses :

  • the private one : (let's say eth0)
  • the public one : X.X.X.X (let's say wan0)

Assuming i am right :

Actually, your SNAT rule is doing NAT for all TCP traffic, when destination is

I am not sure that this rule is relevant because you have already forwarded port 80 in your DNAT rule, and primary and secondary servers are on the same subnet (private IPs) so you don't need specific routing to make them talk together...

I think you should remove your SNAT rule.

In my opinion, your SNAT rule would make more sense to NAT all outgoing traffic to the Internet with your public IP.

Maybe you should change it by adding a filter on outgoing interface, to SNAT only traffic going to your WAN interface :

iptables -t nat -A POSTROUTING -o wan0 -p tcp --dport 80 -j SNAT --to X.X.X.X

But, if your secondary server can already access the Internet, that means your routing and rules are already correct. So you don't need this SNAT rule.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .