I did port forwarding following this tutorial: http://www.debuntu.org/how-to-redirecting-network-traffic-to-a-new-ip-using-iptables/

iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination

iptables -t nat -A POSTROUTING -j MASQUERADE

But i want to MASQUERADE just the ports with the forwardings, because in the same server i have a webserver and if i MASQUERADE all the traffic the web server stops working.

Any idea?

SOLUTION: iptables -t nat -A POSTROUTING -d -p tcp --dport 1111 -j SNAT --to-source

  • Just apply the filter to match only outgoing packets to port from port iptables -t nat -A POSTROUTING - p tcp --sport 1111 -j MASQUERADE
    – Zalmy
    Dec 10, 2015 at 13:16
  • tried adding a tighter match rules? For example, only masquerade when traffic leaves specific interface: iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE or even comes from specific network: iptables -t nat -A POSTROUTING -s -o eth1 -j MASQUERADE and so on Dec 10, 2015 at 13:16
  • @Zalmy it makes sense for me, but it's not working. BTW you have a typo iptables -t nat -A POSTROUTING -p tcp --sport 1111 -j MASQUERADE (a space between - p) This was not the error, because i set up like this 2 MASQUERADE tcp -- tcp spt:40002 and it doesn't work, any idea?? Thanks Dec 10, 2015 at 15:14
  • ... er, hang on, you're trying to source NAT everything you've already DNAT'd? Why? The DNAT should already take care of the reply traffic, that part of iptables connection tracks, it has to or no NAT works. If the DNAT is a standard port forward to an internal subnet, and you just need to MASQ that internal subnet, that I would understand and just filter for that. The blanket MASQ you have up there with no criteria would run MASQ in both directions, and it's no wonder everything screws up.
    – Radhil
    Dec 11, 2015 at 2:29
  • OK, I've read the tutorial, and I've actually not seen NAT used this way. I suppose it could be, but it's not a redirection or a port forward in so much as it's using the box as a middleman translator, and it's not a great solution because it convinces all clients that it runs the service and the server that it's the only client. Zalmy has the right idea but the rule should be matching the new dport or destination IP, which you've already set in the DNAT. so try -t nat -A POSTROUTING -d -p tcp --dport 1111 -j MASQUERADE. Will write up clearer as an answer if I understand correctly.
    – Radhil
    Dec 11, 2015 at 2:57

1 Answer 1


if you really want to do a MASQUERADE then the proper way to do this is like this:

iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination
iptables -t nat -A POSTROUTING -d -p tcp --dport 1111 -j MASQUERADE

this way MASQUERADE will be applied only to DNAT-ed packets.

Note however that MASQUERADE is intended mostly for dynamic IP cases (such as dial-up) and in case of a static IP SNAT should rather be used just the way you proposed. From iptables man page:

It should only be used with dynamically assigned IP (dialup) connections: if you have a static IP address, you should use the SNAT target. Masquerading is equivalent to specifying a mapping to the IP address of the interface the packet is going out, but also has the effect that connections are forgotten when the interface goes down. This is the correct behavior when the next dialup is unlikely to have the same interface address (and hence any established connections are lost anyway).

there is 1 caveat though for both MASQUERADE and SNAT: it won't work if is a VIP on the same machine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .