Sign up ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

I have one server where iptables configured with all chains DROP in filter table

eth0 :- [ Intranet assume as LAN ]
eth2 :- [ External clients assume as WAN ]

Now What I am trying to achieving is , when client[] HIT Port 80 On then it should be nat to internal LAN IP that is

What I have configured to achieve the same [INPUT,OUTPUT,FORWARD Policy is Drop in Filter Chains]

iptables  -A INPUT -s -d -i eth2 -p tcp -m tcp --dport 80 -j ACCEPT
iptables  -A FORWARD -s -j LOG --log-prefix "** TRACING FORWARD CHAIN **" 
iptables  -A FORWARD -s -d -i eth2 -o eth0 -j ACCEPT
iptables  -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables  -t nat -A PREROUTING -s -d -p tcp -m tcp --dport 80 -j DNAT --to-destination

net.ipv4.ip_forward = 1 in sysctl.conf

In Logs:

[17385.347409] ** TRACING FORWARD CHAIN **IN=eth2 OUT=eth0 MAC=xxxxxxxx SRC= DST= LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=9864 DF PROTO=TCP SPT=52874 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0

Now When I Set FORWARD POLICY ACCEPT then it is working but not working with Forward Drop Policy.

So can anyone help me to understand forward policy and which rules should be added in forward policy.

share|improve this question
In the description I read "eth0, eth1", in the code I read "eth2"... – Hauke Laging Feb 24 '13 at 18:15
Opss, that was mistake now it is corrected – Rahul Patil Feb 24 '13 at 18:29

1 Answer 1

This does not really make sense:

iptables  -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

should be

iptables  -A FORWARD -m state --state ESTABLISHED -j ACCEPT

and should be the first FORWARD rule. The logging should probably be limited to new connections:

iptables  -A FORWARD -s -m conntrack --ctstate NEW -j LOG --log-prefix "** TRACING FORWARD CHAIN **"

Edit 1

In case this system is not the gateway for (the default gateway or at least the gateway for you also need SNAT:

iptables -t nat -A POSTROUTING -s -d -j SNAT --to-source 10.0.0.x # the eth0 IP

Use tcpdump to check what packets leave the system via eth0 and which come back.

share|improve this answer
Thanks, let me try.. – Rahul Patil Feb 24 '13 at 18:24
can you tell whey OUTPUT EST not required ?? – Rahul Patil Feb 24 '13 at 18:26
it's not working.. – Rahul Patil Feb 24 '13 at 18:28
@RahulPatil answer edited – Hauke Laging Feb 24 '13 at 20:56
@RahulPatil The OUTPUT chain works on packets which have been created on the system. Read a tutorial about Netfilter basics. If you would open in a browser that runs on this system then the packets created by the browser process would enter the OUTPUT chain. It is completely irrelevant to forwarding. So is INPUT BTW. Your input rule is useless (never matches). – Hauke Laging Feb 24 '13 at 23:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.