I have one server where iptables configured with all chains DROP in filter table

eth0 :- [ Intranet assume as LAN ]
eth2 :- [ External clients assume as WAN ]

Now What I am trying to achieving is , when client[] HIT Port 80 On then it should be nat to internal LAN IP that is

What I have configured to achieve the same [INPUT,OUTPUT,FORWARD Policy is Drop in Filter Chains]

iptables  -A INPUT -s -d -i eth2 -p tcp -m tcp --dport 80 -j ACCEPT
iptables  -A FORWARD -s -j LOG --log-prefix "** TRACING FORWARD CHAIN **" 
iptables  -A FORWARD -s -d -i eth2 -o eth0 -j ACCEPT
iptables  -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables  -t nat -A PREROUTING -s -d -p tcp -m tcp --dport 80 -j DNAT --to-destination

net.ipv4.ip_forward = 1 in sysctl.conf

In Logs:

[17385.347409] ** TRACING FORWARD CHAIN **IN=eth2 OUT=eth0 MAC=xxxxxxxx SRC= DST= LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=9864 DF PROTO=TCP SPT=52874 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0

Now When I Set FORWARD POLICY ACCEPT then it is working but not working with Forward Drop Policy.

So can anyone help me to understand forward policy and which rules should be added in forward policy.

  • In the description I read "eth0, eth1", in the code I read "eth2"... Feb 24, 2013 at 18:15
  • Opss, that was mistake now it is corrected Feb 24, 2013 at 18:29

1 Answer 1


This does not really make sense:

iptables  -A OUTPUT -p tcp -m state --state ESTABLISHED -j ACCEPT

should be

iptables  -A FORWARD -m state --state ESTABLISHED -j ACCEPT

and should be the first FORWARD rule. The logging should probably be limited to new connections:

iptables  -A FORWARD -s -m conntrack --ctstate NEW -j LOG --log-prefix "** TRACING FORWARD CHAIN **"

Edit 1

In case this system is not the gateway for (the default gateway or at least the gateway for you also need SNAT:

iptables -t nat -A POSTROUTING -s -d -j SNAT --to-source 10.0.0.x # the eth0 IP

Use tcpdump to check what packets leave the system via eth0 and which come back.

  • can you tell whey OUTPUT EST not required ?? Feb 24, 2013 at 18:26
  • it's not working.. Feb 24, 2013 at 18:28
  • @RahulPatil answer edited Feb 24, 2013 at 20:56
  • @RahulPatil The OUTPUT chain works on packets which have been created on the system. Read a tutorial about Netfilter basics. If you would open in a browser that runs on this system then the packets created by the browser process would enter the OUTPUT chain. It is completely irrelevant to forwarding. So is INPUT BTW. Your input rule is useless (never matches). Feb 24, 2013 at 23:33
  • My Output Chain is Drop that's why i have added rule in that. it's not unless Feb 25, 2013 at 2:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .