DNAT for connecting a subnet via proxy to the internet

I want to connect a server in a subnet to the internet via a proxy-server. But I can’t ping a host on the internet (www). Actually the subnet-server and the proxy-server share a common dedicated server (virtualization with docker). There are two network-cards (eth0 for the proxy-server and t39 for the subnet-server). So the general layout goes like this:

Internet <==> | <==> is the internal address of the subnet-server, while is the external address and is the internal address of the proxy-server.

First, I have set a static route at the subnet-server with: ip route add via

Question 1: Do I additionally need to explicitly define a default gateway like this? route add default gw eth0 Or would choosing the external address be the right approach?

Then I have set a Masquerade in the iptable of the proxy-server: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Now can ping from the subnet-server to the proxy-server. But I cannot ping from the proxy-server to the internet (for example

To solve my problem, I also consider establishing DNAT somewhat like this (on proxy-server): iptables -t nat -A PREROUTING -d -j DNAT --to-destination

But doesn’t solve my problems. I still cannot ping from the subnet-server to the internet.

Question 3: Do I need to configure DNAT in conjunction with the MASQUERADE to ping the internet? If so, have I choosen the wrong address?

Finally I have heard, that SNAT is not necessary in presence of a MASQUERADE configuration.

Question 4: Is it advisable to configure SNAT, even if I have already set MASQUERADE?

I’m really confused, how to handle this. Although it seems to be a pretty common configuration, my research on Google during the last couple of days didn’t got me any closer to solve the problem.

Has anyone some hints concerning my questions?

  • Why the weird ip scheme? That breaks things in some situations – Canadian Luke May 5 '16 at 16:34
  • Did you enable net.ipv4.ip_forward by sysctl ? – Taichi Yanagiya May 6 '16 at 5:45
  • Good point, IP forwarding happens to be active. – Threx May 6 '16 at 14:05

So I fixed the problem:

As I already guessed, I had to set a separate gateway-entry on with: route add default gw

Now I connected the subnet-server to the www via the proxy while MASQUERADE is active.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.