Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form INTERNET since it has no Public management IP).

Create a secondary/alias WAN Interface on ETH_ROUTER (e.g Primary: eth0.1 (for internet access) and Secondary: eth0.2 (for accessing web server on BRIDGED_DEVICE), (No VLANs).

  • eth0.1 has a public IP;
  • eth0.2 has a static private IP in the BRIDGED_DEVICE's subnet (e.g 10.0.X.Y).

Iptables on ETH_ROUTER: Added a port forward (DNAT) from eth0.1 to eth0.2:

iptables -t nat -I PREROUTING -i eth0.1 -p tcp --dport 80 -j DNAT --to-destination 10.0.X.Y
iptables -t nat -I POSTROUTING -o eth0.2 -s 10.0.X.0/24 -j MASQUERADE

Stateful firewall w/ overall drop policy on FORWARD chain, hence:

 iptables -I FORWARD -i eth0.1 -d 10.0.X.Y -p tcp --dport 80 -j ACCEPT

Can ping from ETH_ROUTER to BRIDGED_DEVICE but unable to reach the web server from Internet. I see packet cont increasing for the DNAT rule but not sure where it disappears in the ETH_ROUTER after that.

ETH_ROUTER is the only device that can be configured to achieve this.

If familiar with this scenario, please suggest what I may be missing or doing wrong here or suggest techniques to debug?

1 Answer 1


Check default gateway on bridged device and forwarding rule from bridged device to internet also. If you don't care about internet source ip you can add a source nat from router to bridged device.

  • Sorry, forgot to mention that I cannot configure the bridged device, have to do everything on ETH_ROUTER. Thanks.
    – sjose109
    Jun 9, 2014 at 18:52
  • Well, so you have to dnat in first place to redirect packet to brdged device and than snat or masquerade packet to let bridged device believe that them comes from router.
    – user70760
    Jun 10, 2014 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.