So, not concerning ourselves with the WHY, and more so with the HOW, I'd like to see if anyone knows where I'm going wrong here.

Basically, I'd like to forward all packets headed for port 80 on an IP that I've aliased to the loopback device ( to be forwarded to port 8080 on another IP, which happens to be the public IP of the same box (we'll use for the purpose of this question). In doing so, I should [ostensbily] be able to run

telnet 80

and reach, however, this is not happening.

Here is my nat table in iptables:

~# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 66 packets, 3857 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       tcp  --  *      *        tcp dpt:80 to:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Am I missing something? I've followed most the information in the iptables man pages and also in the links below, however, am still getting a "connection refused" during my telnet attempts. I have tried adding ~#iptables -t nat -A POSTROUTING -j MASQUERADE to my iptables, but to no avail :/

If anyone could point me in the right direction that would be phenomenal!



EDIT I wanted to add that I do indeed have the following sysctl parameter enabled ~# sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1

EDIT No. 2 I was able to solve this by adding the rule to the OUTPUT chain in the nat table, v.s. the PREROUTING chain as I originally tried.

  • You don't need port 8080, I watch 8080 in your output. – PersianGulf Mar 2 '16 at 22:12
  • had you enabled the net.ipv4.ip_forward=1 parameter? – tachomi Mar 2 '16 at 22:49
  • Ah yes, I forgot to mention in my question that I HAVE indeed enabled that sysctl parameter: ~# sysctl net.ipv4.ip_forward net.ipv4.ip_forward = 1 – Andre Goree Mar 4 '16 at 16:09
  • @PersianGulf I'm not sure what you're saying...can you elaborate? – Andre Goree Mar 4 '16 at 16:09

Yes you should put dnat in OUTUPT table because packets generated locally would not pass PREROUTING table.

| improve this answer | |

I actually got this working by ensuring the kernel module "br_netfilter" was loaded on the host machine. It was as simple as that, annoyingly simple after being stumped for so long.

Documentation/articles that lead me to the solution:


https://github.com/omribahumi/libvirt_metadata_api and https://thewiringcloset.wordpress.com/2013/03/27/linux-iptable-snat-dnat/

See "Setting up iptables" section – I'm using 'DNAT' instead of 'REDIRECT' bc 'REDIRECT' simply redirects traffic to an interface on the local system, rather than forwarding to a removed address as in the case of destination NAT.


https://serverfault.com/questions/179200/difference-beetween-dnat-and-redirect-in-iptables and https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html

Helped me understand the diff between REDIRECT & DNAT, as stated above.



This commit led me to the actual solution (the above things I'd already been doing before, but to no avail).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.