Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up an Ubuntu 11.10 server to act as firewall for a network running several different SSL websites. The idea is fairly common: have all public IP's for each site aliased to the public interface on the firewall and use iptables/NAT to forward connections in to the web servers. I'm having a devil of a time getting this fairly simple thing to work though.

Say I have a public-facing interface on the firewall:


And I want to alias a new IP to that public interface:

ifconfig eth0:0

I then see the interface is created and I can ping it from other hosts. So far so good. Now I have my web server sitting on the DMZ side of the network, accessible by the firewall but not the public. Let's say the internal web server is So I create a NAT rule as follows:

iptables -t nat -A PREROUTING -i eth0 -d -j DNAT --to-destination

It just doesn't want to work. If I run tcpdump on the public interface, it will see the incoming traffic, but iptables just won't NAT it to the destination.

It will work fine if I use a non-aliased IP, such as I've read that iptables doesn't like working with virtual interfaces and ignores them. That's fine, but it should still be working with "eth0" instead of "eth0:0". In my case, iptables does not complain if I try to use "eth0:0" but it doesn't make any difference.

I've been using OpenBSD for a long time now, so I'm comfortable setting this same thing up with pf. But years ago I used to do this with a RedHat box and it worked just fine. Has something changed? There has to be a way to do this. I've seen several examples from other folks saying that you just need to make sure you specify the main device (eth0) instead of using eth0:0. But I've got nothing.

Oh, and to rule out that this is just a filtering problem, I've completely disabled all filter rules:

iptables -F
iptables -X
iptables -P INPUT ACCEPT

Any ideas? I'm certainly no newbie when it comes to iptables, but this problem is starting to make me feel like one.

share|improve this question

When you use virtual interfaces just use the option -d (destination), ignoring the option -i (interface)

Instead of:
iptables -t nat -A PREROUTING -i eth0 -d -j DNAT --to-destination

iptables -t nat -A PREROUTING -d -j DNAT --to-destination

Work with iptables v1.4.14 in Debian

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .