Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the iptables rules below forwarding incoming ssh traffic on port 2222 to a virtual machine running in a vmware "vmnet" network on the same host.
+---------+     +------+     +-----------------+ 
| network |---->| host |__   | virtual machine |
+---------+     +------+ \\__+-----------------+

In the auth.log of the virtual machine, the incoming IP address for remote logins is always the IP of the host that forwarded the packets. How can I preserve the remote IP information?

:INPUT ACCEPT [593178:45807398]
:FORWARD ACCEPT [881:158378]
:OUTPUT ACCEPT [859348:1232593358]
-A FORWARD -d -o vmnet99 -p tcp -m tcp --dport 22 -j ACCEPT

:INPUT ACCEPT [658:122878]
:OUTPUT ACCEPT [3266:229178]
-A PREROUTING -p tcp -m tcp --dport 2222 -j DNAT --to-destination
share|improve this question
up vote 2 down vote accepted

Your last iptables rule,


is masquerading all packets leaving the host, including those to the VM: this is the reason why you see, on the host, all packets as coming from the host. You should instead limit masquerading to packets leaving the host for the internet, something like


if you call eth0 the interface connected to the Internet.


If the question is what else do I need to make IP forwarding work, then a sufficient answer is:

  sudo iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to-destination
share|improve this answer
I've been searching around, and I wonder if I need this too. Should I be adding these rules also? -A POSTROUTING -o vmnet99 -j SNAT --to-source – RaWkStAr Dec 19 '13 at 16:53
I see your edits and thank you for your answer. Could you let me know why the SNAT is necessary though? I just happened to come across that rule-type during my research and I wondered if it was needed. Now I see it in your answer and I am wondering what purpose it serves? Thanks. – RaWkStAr Dec 19 '13 at 17:48
I don't have enough reputation to upvote your answer Marius, but I offer you my gratitude. Thanks for taking the time to help. Good answer! – RaWkStAr Dec 19 '13 at 18:47
@linuxrawkstar The reason why you do not need the rule with SNAT is that you already have the MASQUERADE rule. They perform the same action (to masquerade the source IP of each packet) but MASQUERADE checks the router (in your case, your pc) IP address every time, while SNAT is used when you already know that you want the packet to come from a given IP address. In other words: if your pc address changes every time, use MASQUERADE; if it has a static IP, you may use SNAT which is faster. – MariusMatutiae Dec 19 '13 at 19:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.