I have a adsl connection with static IP (lets say My debian firewall connects Internet with ppp and IP is assigned to firewall directly; ppp0 Link encap:Point-to-Point Protocol inet addr: P-t-P:<IP-DOES-NOT-MATTER> Mask:

I am using debian as a firewall/router and NAT my local clients to Internet using a basic iptables script; iptables --table nat --append POSTROUTING --out-interface ppp0 -j MASQUERADE iptables --append FORWARD --in-interface eth1 -j ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward

I created a subdomain record for my external hosted domain: sub.example.com IN A

I can DNAT http connections from Internet to my local server with iptables: iptables --table nat --append PREROUTING -i ppp0 --dest -p tcp --dport 80 -j DNAT --to

I also want my local clients to reach sub.example.com without any additional configuration.

The iptables commands i tried in firewall (that did not work): iptables --table nat --append PREROUTING --in-interface eth1 --dest -p tcp --dport 80 -j DNAT --to-destination and iptables -t nat --append OUTPUT --dest -p tcp --dport 80 -j DNAT --to-dest

First command routed packects to server but i did not get a reply ( not configured on server). Second one did nothing.

Is there a way to accomplish this with iptables ?

  • You may need to also do source NAT as otherwise will see the source IP of 192.168.1.x and hence does not route the return packet via your gateway system but directly to 192.168.1.x; that system isn't expecting anything from and sends a reset back.
    – wurtel
    Commented Mar 5, 2015 at 8:18

1 Answer 1


After @wurtel's answer i used DNAT and SNAT together and it worked. Thanks for it :)

The commands are: iptables --table nat --append PREROUTING --in-interface eth1 --dest -p tcp --dport 80 -j DNAT --to-destination iptables --table nat --append POSTROUTING --out-interface eth1 -source --dest -p tcp --dport 80 -j SNAT --to-source

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .