I want to access certain websites via a public proxy and I can't seem to get it right using iptables. Let's say I want to access example.com having ip address via a public proxy at What I do is:

iptables -t nat -A PREROUTING --dst -p tcp --dport 80 -j DNAT --to-destination
iptables -t nat -A POSTROUTING --dst -p tcp --dport 8080 -j SNAT --to-source
iptables -t nat -A OUTPUT --dst -p tcp --dport 80 -j DNAT --to-destination

But then I can't load the webpage at all (as if the proxy is not reachable, but it is, because I test it by setting it in the browser's proxy settings when no routing rules are set). What am I doing wrong?


First thing is to enable IP forwarding using:

echo "1" > /proc/sys/net/ipv4/ip_forward

Then add pre-routing rule using (I think you dont need to mention whole network):

iptables -t nat -A PREROUTING --dst -p tcp --dport 80 -j DNAT --to-destination

Add post-routing rule using:

iptables -t nat -A POSTROUTING -j MASQUERADE
  • Thank you for your reply! I had indeed forgotten to enable ip forward, but even after doing so, it doesn't work: Adding the two rules you suggested does not go through the proxy (I tried using wtfismyip.com as the example.com and I can see my real public IP). Adding the OUTPUT rule I originally had, gets me back to where I was (I cannot connect at all) Replacing the PREROUTING with OUTPUT, simply loads the default page of the proxy server. I'm a bit confused as to which rule applies to which packet in my case... I want to stress that both target and proxy ip addresses here are external. – Aayla Secura Jan 31 '15 at 11:25
  • My first iptables rule translates the destination IP address of the packet from to and port from 80 to 8080. The second rules translates the source IP address of packet to the outbound interface of your linux machine. – arshan Feb 3 '15 at 10:11
  • Thanks, I see, this is what I thought as well. But just these two rules do not make any apparent change (I still see my real IP address), so something must be missing... – Aayla Secura Feb 4 '15 at 15:08
  • After reading blog.webernetz.net/2014/01/22/… you can see that the packets must be forwarded to proxy server (i guess its working well in our case). Are you sure that proxy server is working as it should be? – arshan Feb 4 '15 at 18:43
  • Thank you for your reply, the blog post clears some things up. I figured out why no change to the packets was happening: as explained here: askubuntu.com/questions/280948/… , I need to use the OUTPUT chain, instead of PREROUTING, since iptables is running on my machine, the same machine as the web browser establishing connection to With the OUTPUT rule I am being redirected to the proxy server (which works fine), but I am getting it's / page (login) rather than the requested site (to be continued in the following post) – Aayla Secura Feb 5 '15 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.