0

I am trying to configure destiation NAT on a RHEL 7.4 server. I want any traffic generated for 10.10.10.10:443 to go to 10.20.20.20:443.

After some Googling I used following direct rule:

firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -d 10.10.10.10 -p tcp --dport 443 -j DNAT --to-destination 10.20.20.20:443

I could see it in the PREROUTING_direct chain.

# iptables -t nat -vxnL PREROUTING_direct
Chain PREROUTING_direct (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DNAT       tcp  --  *      *       0.0.0.0/0            10.10.10.10          tcp dpt:443 to:10.20.20.20:443

But when I telnet to 10.10.10.10:443 it doesn't redirect to 10.20.20.20:443

I do not see the rule is hit (pkts = 0, bytes = 0). Event tcpdump doesn's how any traffic going to 10.20.20.20.

Cheers,

J

  • Just realised that as the traffic was generated on the machine, I should have used OUTPUT chain instead of PREROUTING. Following worked for me: firewall-cmd --direct --add-rule ipv4 nat OUTPUT 0 -d 10.30.200.8 -p tcp --dport 443 -j DNAT --to-destination 10.70.7.8:443 – Jigar Aug 6 '18 at 2:17

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.