Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to setup my raspberry pi to sit between my router and my modem. I'm basically trying to set it up as an intercepting proxy so that all web traffic goes through the proxy.

I have the modem connected to eth0 and the router to eth1. Everything works fine now, I have my iptables setup and all web traffic goes through the proxy. What I need to make happen though, is allow all incoming traffic on eth0 to go directly to eth1. Is this possible to do with iptables or do I need to create a bridge between the 2 to make this happen.

If I need to create a bridge, how can I do that while still intercepting web traffic?

share|improve this question
There are a lot of resources on the net about NAT using iptables. For example And actually, securing your internet access will require that you master some other topics that can't be summed up here. – Cilyan Feb 7 '14 at 22:05
@Cilyan thanks for the link. I've come across that post before, and the setup he has is basically what I did. This is not the issue though, NAT is fine. This works fine for traffic initiated from eth1, but not the other way around. I need the outside world (eth0) to be able to connect to any arbitrary port and let the router (which is connected to eth1) decide what to do with that traffic – George Feb 7 '14 at 22:14
Will the routing from eth0 to eth1 target a single IP? Or do you want to do port-forwarding? NATing is done to mask the underlying network, so you won't be able to distinguish destination machines from the outside. – Cilyan Feb 7 '14 at 22:23
Just a single ip – George Feb 7 '14 at 22:33
Then you are looking for DNAT:… Interesting tips here too: You don't need to specify a port range. – Cilyan Feb 7 '14 at 23:55
up vote 2 down vote accepted

What you need is Destination NAT (DNAT): A good start is this post on SU: Use port forwarding with masquerade

You don't actually need to specify a port range.

# iptables -t nat -A PREROUTING -i eth0 -j DNAT --to ${LAN_SERVER_IP}

See netfilter documentation or this page

This page also has some information about possible caveats when reaching the server from LAN (it has to be SNAT-ed).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .