I am using Centos7 in my physical server with public address and I have guest machine running on KVM environment with private IP address I need to install httpd in the guest machine and redirect the traffic from the public IP address to the private adress tried: iptables -t Nat -A PREROUTING -I em1 -p TCP --deport 80 -j DNAT --to-destination where: em1 is my network interface in the physical machine, but it is not working.the forwording is actived and the command iptables -nvL return:

Chain FORWARD (policy DROP 12 packets, 720 bytes) pkts bytes target prot opt in out source destination
7 420 ACCEPT tcp -- * * tcp dpt:80

Chain OUTPUT (policy ACCEPT 406 packets, 59695 bytes) pkts bytes target prot opt in out source destination
0 0 DROP icmp -- * * icmptype 0



1 Answer 1


Your ruleset is missing the stateful part allowing the return path for incoming traffic. Without it, TCP SYN packets are accepted from remote (as witnessed with the packet counters: 7) but reply packets (starting with TCP SYN-ACK) from inside to the original remote source most probably get dropped by the default policy DROP rule (as seen with the 12 dropped packets, probably replies plus a few retries).

Insert the stateful rules like this as the two first rules in the natural order by specifying their position:

iptables -I FORWARD 1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD 2 -m conntrack --ctstate INVALID -j DROP

The second rule (... --ctstate INVALID -j DROP) should be used too especially if later, some rules REJECT packets rather than just DROP them.

If that's not enough to solve your problem, you should add the output of this command in the question so I can try and help further:

iptables-save -c

iptables-save, contrary to iptables -nvL produces a complete and reproducible (using iptables-restore) ruleset.

Please also note that:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .