Need to access web server on BRIDGED_DEVICE's LAN from INTERNET via ROUTER (BRIDGED_DEVICE web server cannot be accessed form INTERNET since it has no Public management IP).

Create a secondary/alias WAN Interface on ETH_ROUTER (e.g Primary: eth0.1 (for internet access) and Secondary: eth0.2 (for accessing web server on BRIDGED_DEVICE), (No VLANs).

  • eth0.1 has a public IP;
  • eth0.2 has a static private IP in the BRIDGED_DEVICE's subnet (e.g 10.0.X.Y).

Iptables on ETH_ROUTER: Added a port forward (DNAT) from eth0.1 to eth0.2:

iptables -t nat -I PREROUTING -i eth0.1 -p tcp --dport 80 -j DNAT --to-destination 10.0.X.Y
iptables -t nat -I POSTROUTING -o eth0.2 -s 10.0.X.0/24 -j MASQUERADE

Stateful firewall w/ overall drop policy on FORWARD chain, hence:

 iptables -I FORWARD -i eth0.1 -d 10.0.X.Y -p tcp --dport 80 -j ACCEPT

Can ping from ETH_ROUTER to BRIDGED_DEVICE but unable to reach the web server from Internet. I see packet cont increasing for the DNAT rule but not sure where it disappears in the ETH_ROUTER after that.

ETH_ROUTER is the only device that can be configured to achieve this.

If familiar with this scenario, please suggest what I may be missing or doing wrong here or suggest techniques to debug?

1 Answer 1


Check default gateway on bridged device and forwarding rule from bridged device to internet also. If you don't care about internet source ip you can add a source nat from router to bridged device.

  • Sorry, forgot to mention that I cannot configure the bridged device, have to do everything on ETH_ROUTER. Thanks.
    – mbedsys
    Commented Jun 9, 2014 at 18:52
  • Well, so you have to dnat in first place to redirect packet to brdged device and than snat or masquerade packet to let bridged device believe that them comes from router.
    – user70760
    Commented Jun 10, 2014 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .