Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm setting up an Ubuntu 11.10 server to act as firewall for a network running several different SSL websites. The idea is fairly common: have all public IP's for each site aliased to the public interface on the firewall and use iptables/NAT to forward connections in to the web servers. I'm having a devil of a time getting this fairly simple thing to work though.

Say I have a public-facing interface on the firewall:

eth0 25.25.25.25

And I want to alias a new IP to that public interface:

ifconfig eth0:0 25.25.25.26

I then see the interface is created and I can ping it from other hosts. So far so good. Now I have my web server sitting on the DMZ side of the network, accessible by the firewall but not the public. Let's say the internal web server is 172.16.2.1. So I create a NAT rule as follows:

iptables -t nat -A PREROUTING -i eth0 -d 25.25.25.26 -j DNAT --to-destination 172.16.2.1

It just doesn't want to work. If I run tcpdump on the public interface, it will see the incoming traffic, but iptables just won't NAT it to the destination.

It will work fine if I use a non-aliased IP, such as 25.25.25.25. I've read that iptables doesn't like working with virtual interfaces and ignores them. That's fine, but it should still be working with "eth0" instead of "eth0:0". In my case, iptables does not complain if I try to use "eth0:0" but it doesn't make any difference.

I've been using OpenBSD for a long time now, so I'm comfortable setting this same thing up with pf. But years ago I used to do this with a RedHat box and it worked just fine. Has something changed? There has to be a way to do this. I've seen several examples from other folks saying that you just need to make sure you specify the main device (eth0) instead of using eth0:0. But I've got nothing.

Oh, and to rule out that this is just a filtering problem, I've completely disabled all filter rules:

iptables -F
iptables -X
iptables -P FORWARD ACCEPT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

Any ideas? I'm certainly no newbie when it comes to iptables, but this problem is starting to make me feel like one.

share|improve this question
add comment

1 Answer 1

When you use virtual interfaces just use the option -d (destination), ignoring the option -i (interface)

Instead of:
iptables -t nat -A PREROUTING -i eth0 -d 25.25.25.26 -j DNAT --to-destination 172.16.2.1

use:
iptables -t nat -A PREROUTING -d 25.25.25.26 -j DNAT --to-destination

Work with iptables v1.4.14 in Debian

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.