Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux firewall with 3 NIC's. Eth1 is my LAN's default gateway and has IP address and is connected to my LAN with IP range Eth2 has IP address of and gateway is which is eth1's gateway and connected to a DSL modem. The DSL modem connects to the internet with a dial-up script on the Linux firewall and gets assigned a dynamic IP on its ppp0 interface.

Eth0 is connected to a second modem with a static public IP. Eth0 is also assigned a public IP in the range specified by the service provider.

I have a web server on one of the internal pc's on the lan on IP The public has to be able to connect to the web server on the static public IP. I tried some IPTABLES rules such as DNAT, MASQUERADE with no luck. Maybe I am missing something. Can someone direct me to some sort of solution?

share|improve this question

You need 4 things.

  • handle the incoming connection:
    • iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to
  • allow it through the firewall:
    • iptables -t filter -A FORWARD -i eth0 -o eth2 -p tcp --dport 80 -j ACCEPT
  • allow the reply traffic through the firewall:
    • iptables -t filter -A FORWARD -i eth2 -o eth0 -p tcp --sport 80 -j ACCEPT
  • source NAT or MASQ the reply outgoing:
    • iptables -t nat -A POSTROUTING -i eth2 -o eth0 -s --sport 80 -j MASQERUADE

The two in the middle can be omitted if you don't actually block any traffic at your firewall. The main thing is that you need to tell your box how to handle incoming traffic destined for port 80 (--dport 80) and how to handle the reply traffic (source nat it/masq it).

A little information on the chains. The NAT PREROUTING chain mangles (changes) packet header information BEFORE the packet is routed/forwarded (i.e. crosses the FORWARD chain). The NAT POSTROUTING chain mangles the packet after routing. So, when the packet hits the public if, you need to change the destination address to the internal web server address. Then it will route the packet and cross the forward chain. If you run a TCP dump on the web server, you'll see the incoming traffic and the outgoing reply. When the outgoing reply hits the firewall, it will be routed and then cross the POSTROUTING chain. The packet will then get mangled again to change the source address from the RFC1918 Private IP range of 10.1.x.x to the public main IP on eth0.

share|improve this answer
I had to edit this to add the chains, forgot them. – Sean C. Jan 25 '12 at 15:03
Also, the incoming and outgoing interfaces on the last line were transposed. Sorry, I'm writing rules from memory. – Sean C. Jan 25 '12 at 15:19
This line: iptables -t nat -A POSTROUTING -i eth2 -o eth0 -s --sport 80 -j MASQERUADE should be: iptables -t nat -A POSTROUTING -o eth0 -s -p tcp --sport 80 -j MASQUERADE – user125210 Jul 27 '15 at 23:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.