I am trying to configure destiation NAT on a RHEL 7.4 server. I want any traffic generated for to go to

After some Googling I used following direct rule:

firewall-cmd --direct --add-rule ipv4 nat PREROUTING 0 -d -p tcp --dport 443 -j DNAT --to-destination

I could see it in the PREROUTING_direct chain.

# iptables -t nat -vxnL PREROUTING_direct
Chain PREROUTING_direct (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DNAT       tcp  --  *      *            tcp dpt:443 to:

But when I telnet to it doesn't redirect to

I do not see the rule is hit (pkts = 0, bytes = 0). Event tcpdump doesn's how any traffic going to



  • Just realised that as the traffic was generated on the machine, I should have used OUTPUT chain instead of PREROUTING. Following worked for me: firewall-cmd --direct --add-rule ipv4 nat OUTPUT 0 -d -p tcp --dport 443 -j DNAT --to-destination – Jigar Aug 6 '18 at 2:17

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.