I have a Linux machine (RHEL 6.7) with 2 IP's configured on a single NIC (eth1). The primary address, and therefore the address that all traffic appears to come from, is The other is

I am looking for a way to use iptables to change the source IP based on the destination address of a packet. Normally the traffic will 'go out on', but say my packet is destined for, I want that packet to 'go out on'

The reason for this is firewalls on the network that are out of my control. There are rules in place allowing traffic from to, but not from to

I don't want all traffic to originate from, only that destined for

I was looking at using the nat table and maybe a prerouting rule, but don't see a way to change the source address. If it would help I could create an alias for eth1 (so there would be eth1 and eth1:0) but would like to see if there's a solution in the current config.

Thanks in advance for any advice.

  • Is there a particular reason for wanting to do this with iptables? The behaviour you described is easily achieved by modifying the routing table. Commented Nov 17, 2015 at 19:59

1 Answer 1


Here are two different methods of achieving the desired behaviour:

1. Using iptables

The SNAT target in iptables allows the source address to be modified as you requested. The man page for iptables-extensions has this to say about SNAT:

This target is only valid in the nat table, in the POSTROUTING and INPUT chains, and user-defined chains which are only called from those chains. It specifies that the source address of the packet should be modified (and all future packets in this connection will also be mangled), and rules should cease being examined.

Based on your question, the following rule will change the source address of packets destined for to

$ iptables -t nat -A POSTROUTING --destination -j SNAT --to-source

2. Using a static route

Alternatively, instead of an iptables rule, add a static route for the destination host to the routing table, using the following syntax:

$ ip route add <destination>/32 via <gateway> src <alias>

Based on the information you provided, you would use:

$ ip route add via <gateway> src

Replace <gateway> with the actual IP address of your gateway, as this wasn't provided in your question.

Traffic destined for will now originate from Any other traffic takes the default route, originating from

  • soulcake - there is no particular reason why I want to use iptables to accomplish this. Your option one works just fine, thank you. Your option two is not working for me, when I add your rule I can no longer ping my destination. So you have solved my problem, but I don't think I should mark the question answered since the rule doesn't work for me. Either way, many thanks.
    – eliszka
    Commented Nov 18, 2015 at 18:19
  • @eliszka If you could post the output of ip addr for the interface you're working with I could possibly help you with the static route method. Other than that, I think the answer specifically addresses what you were requesting, and likely deserves an upvote at least? Commented Nov 18, 2015 at 18:41
  • I will mark it answered since, if you remove 'iptables' from the title it is in fact answered. Your routing solution works for me but the iptables rule does not.
    – eliszka
    Commented Nov 18, 2015 at 20:29
  • @eliszka I misunderstood in that case. In your first comment you mentioned 'option two is not working', which I took to refer to the static route as this was labelled as the second option. You could try running tcpdump -i <interface> 'icmp[icmptype] = icmp-echo' on host, and then run ping from host The tcpdump command will show you whether your ICMP request packets are at least reaching the host. Can you confirm? It could be the case that this traffic isn't making it through your firewall. Commented Nov 18, 2015 at 20:52
  • After applying your iptables rule I get 100% packet loss pinging from, however the packets are making it to per the ICMP echo request output I see running your tcpdump command on
    – eliszka
    Commented Nov 19, 2015 at 21:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .