Iptables MASQUERADE only selected ports

Question

I did port forwarding following this tutorial: http://www.debuntu.org/how-to-redirecting-network-traffic-to-a-new-ip-using-iptables/

iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination 2.2.2.2:1111

iptables -t nat -A POSTROUTING -j MASQUERADE

But i want to MASQUERADE just the ports with the forwardings, because in the same server i have a webserver and if i MASQUERADE all the traffic the web server stops working.

Any idea?

SOLUTION: iptables -t nat -A POSTROUTING -d 2.2.2.2 -p tcp --dport 1111 -j SNAT --to-source 2.2.2.1

Answer 1

if you really want to do a MASQUERADE then the proper way to do this is like this:

iptables -t nat -A PREROUTING -p tcp --dport 1111 -j DNAT --to-destination 2.2.2.2:1111
iptables -t nat -A POSTROUTING -d 2.2.2.2 -p tcp --dport 1111 -j MASQUERADE

this way MASQUERADE will be applied only to DNAT-ed packets.

Note however that MASQUERADE is intended mostly for dynamic IP cases (such as dial-up) and in case of a static IP SNAT should rather be used just the way you proposed. From iptables man page:

It should only be used with dynamically assigned IP (dialup) connections: if you have a static IP address, you should use the SNAT target. Masquerading is equivalent to specifying a mapping to the IP address of the interface the packet is going out, but also has the effect that connections are forgotten when the interface goes down. This is the correct behavior when the next dialup is unlikely to have the same interface address (and hence any established connections are lost anyway).

there is 1 caveat though for both MASQUERADE and SNAT: it won't work if 2.2.2.2 is a VIP on the same machine.