Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up an Ubuntu 11.10 server to act as firewall for a network running several different SSL websites. The idea is fairly common: have all public IP's for each site aliased to the public interface on the firewall and use iptables/NAT to forward connections in to the web servers. I'm having a devil of a time getting this fairly simple thing to work though.

Say I have a public-facing interface on the firewall:


And I want to alias a new IP to that public interface:

ifconfig eth0:0

I then see the interface is created and I can ping it from other hosts. So far so good. Now I have my web server sitting on the DMZ side of the network, accessible by the firewall but not the public. Let's say the internal web server is So I create a NAT rule as follows:

iptables -t nat -A PREROUTING -i eth0 -d -j DNAT --to-destination

It just doesn't want to work. If I run tcpdump on the public interface, it will see the incoming traffic, but iptables just won't NAT it to the destination.

It will work fine if I use a non-aliased IP, such as I've read that iptables doesn't like working with virtual interfaces and ignores them. That's fine, but it should still be working with "eth0" instead of "eth0:0". In my case, iptables does not complain if I try to use "eth0:0" but it doesn't make any difference.

I've been using OpenBSD for a long time now, so I'm comfortable setting this same thing up with pf. But years ago I used to do this with a RedHat box and it worked just fine. Has something changed? There has to be a way to do this. I've seen several examples from other folks saying that you just need to make sure you specify the main device (eth0) instead of using eth0:0. But I've got nothing.

Oh, and to rule out that this is just a filtering problem, I've completely disabled all filter rules:

iptables -F
iptables -X
iptables -P INPUT ACCEPT

Any ideas? I'm certainly no newbie when it comes to iptables, but this problem is starting to make me feel like one.

share|improve this question

When you use virtual interfaces just use the option -d (destination), ignoring the option -i (interface)

Instead of:
iptables -t nat -A PREROUTING -i eth0 -d -j DNAT --to-destination

iptables -t nat -A PREROUTING -d -j DNAT --to-destination

Work with iptables v1.4.14 in Debian

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.