I have following networking setup:


Internet <-- eth0 : a.b.c.d (static address)
Clients <-- eth1  : DHCP at server at, leasing


Gateway <-- eth0:

Clients can reach internet and forwarding is working. I want to create some kind of "virtual" address, which clients can access via gateway, but that address would be in fact some machine on the Internet.

So, when they connect to they in fact connect to google and so on. I tried it with NAT:

TARGET=$(dig -q google.com)
iptables -t nat -A PREROUTING -d "$VIRTUAL" -j DNAT --to "$TARGET"
iptables -t nat -A POSTROUTING -s "$TARGET" -j SNAT --to "$VIRTUAL"

that somehow works, however when I ping it from gateway I get

From 20.249.x.y icmp_seq=1 Destination Net Unreachable

(where 20.249.x.y is my Gateway's gateway), and when I traceroute to that virtual IP from the client, I get this:

traceroute to (, 30 hops max, 38 byte packets
 1 (  31.886 ms  31.638 ms  34.029 ms
 2 (  39.660 ms  40.489 ms  39.153 ms
 3 (  41.879 ms  40.367 ms  40.436 ms
 4 (  47.375 ms  48.200 ms  48.878 ms
 5 (  47.801 ms  47.280 ms  47.405 ms

That looks super weird to me. Is there a way to fix these issues? I was trying to use ip tunnel, but it looks like it needs different end setting up as well, which I obviously cannot do.

iptables config on server contains these two rules and -A FORWARD -i eth1 -j ACCEPT only.

  • ping might not work on internet hosts, when targeting google.com does wget work ? if yes you are done.
    – Archemar
    Apr 22, 2021 at 8:44

2 Answers 2


You might want to flush existing broken iptables rules, and start from scratch. On the Linux box acting as gateway, assume the following conditions:

The linux gateway has two NICs; eth0 is LAN facing while eth1 is WAN facing.

Enable IP packet forwarding on the gateway:

$ sudo echo 1 > /proc/sys/net/ipv4/ip_forward

Create two test virtual IPs (VIP) on eth0 as per our test plan

$ sudo ifconfig eth0:1 netmask
$ sudo ifconfig eth0:2 netmask

Configure iptables as per our plan

sudo iptables -t nat -A PREROUTING -d -j DNAT --to
sudo iptables -t nat -A PREROUTING -d -j DNAT --to
sudo iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

In this case, when a user ping the VIP, there will be redirected to Cloudflare's

If a user ping the VIP they will be redirected to Google's ---> --->
  • Thanks, for some reason SNAT wasn't doing much but doing MASQUERADE solved my problem
    – user37741
    Jul 10, 2021 at 17:12

I tried it with NAT [...] that somehow works, however when I ping it from gateway I get [network unreachable]

As the name implies, the PREROUTING and POSTROUTING chains are only used for packets that come in to the gatway and are routed to go outside.

That means in particular that they don't apply to any packets the originate on the gatway, like the ping you are doing. There is no way to fix that, the filter chains are just weird this way. But for your usecase, you only want the NAT from the clients, so it doesn't matter.

(And BTW, you only need DNAT; this will create a CONNTRACK entry, and the reverse NAT will be done automatically).

  • Thanks, I've tried with DNAT only but it didn't work
    – user37741
    Jul 10, 2021 at 17:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .