I've been trying to NAT HTTPS traffic on an external IP (say debianIP1) to an internal IP (say debianIP2) based on several examples/guides, like:

How to do port forwarding/redirecting on Debian?

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/Security_Guide/s1-firewall-ipt-fwd.html and


Unfortunetly, I'm not able to get it working. This is what I do op debianIP1:

/etc/sysctl.conf file, net.ipv4.ip_forward = 1 (IPv4 portforwarding enabled)


  • iptables -t nat -A POSTROUTING -o venet0:0 -j MASQUERADE

  • iptables -t nat -A PREROUTING -i venet0:0 -p tcp --dport 443 -j DNAT --to debianIP2:443

  • iptables -A FORWARD -i venet0:0 -p tcp --dport 443 -d debianIP2 -j ACCEPT

When on debianIP1, and I perform:

  • telnet debianIP2 443 - I can see I'm connected

  • telnet localhost 443 - I get connection refused

venet0:0 is used as this is the only interface that shows an external IP (other is venet0 and lo). Including venet0 for venet0:0 provides the same result.

Can somebody tell me what I'm missing?

2 Answers 2


Try --to-destination which is not same as --to

Explained here


Based on the answer below I added --to-destination instead of --to, but that didn't solve it unfortunately. Connection refused.

  • Welcome to Server Fault and for your interest in it. However, your post does not answer the question that was asked and so should not be posted as an answer. If you have a different question, you can ask it by clicking Ask Question. See also: How to Ask. Feb 27, 2019 at 7:48
  • OK, I wanted to respond to the answer provided, my first attempt (with more information on other efforts) was removed. I could not add a comment to that, editing the first question didn't seem appropriate as well. So I added another answer, which may not be appropriate as well. I will edit the question for the answer provided.
    – yetser
    Feb 27, 2019 at 10:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .