Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to locally redirect ports on my Ubuntu machine using iptables. Similar to transparent proxying. I want to catch anything trying to leave my system on port 80 and redirect it to a remote host and port.

Can I achieve this using the NAT and pre-routing functions of iptables?

share|improve this question
up vote 9 down vote accepted

Try this iptables rule:

$ sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination IP:80

The above says to:

  • Add the following rule to the NAT table (-t nat).
  • This rule will be appended (-A) to the outbound traffic (OUTPUT).
  • We're only interested in TCP traffic (-p tcp).
  • We're only interested in traffic who's destination port is 80 (--dport 80).
  • When we have a match, jump to DNAT (-j DNAT).
  • Route this traffic to some other server's IP @ port 80 (--to-destination IP:80).

What's DNAT?

    This target is only valid in the nat table, in the PREROUTING and OUTPUT 
    chains, and user-defined chains which are only called from those chains.
    It specifies that the destination address of the packet should be modified 
    (and all future packets in  this  connection will also be mangled), and
     rules should cease being examined.


share|improve this answer
thanks for that but it does not seem to work. I have however since found this that does work. – pjf Aug 8 '13 at 6:20
sudo iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination xx.xx.xx.xx:3128 – pjf Aug 8 '13 at 6:21
Is that because this is locally and not through a gateway? your SNAT would work through a gateway? – pjf Aug 8 '13 at 6:22
@pjf - I believe so. I've updated my answer. – slm Aug 8 '13 at 6:25
@pjf - I found both rules and was in the process of updating my answer with both. I wasn't sure which situation you were in though. – slm Aug 8 '13 at 6:30

This can allow you to translate ports to all IP addresses. The main difference here is the absense of an IP address in the --to-destination field.

iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination :80
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.