We have 3 PCs, two of it are connected to internet (both of it have 2 NIC)


eth0 - (external IP)
eth1 - (internal IP)


eth0 - (external IP)
eth1 - (internal IP)


eth0 - (internal IP)

Now we want to forward port 80 from PC1 and PC2 to PC3.

But there is the problem: iptables port forwarding works well from PC1 or PC2, but only in case if PC3 have PC1 or PC2 as gateway.

IPtables rules (for PC1):

iptables -t nat -A PREROUTING  -p tcp -d --dport 80 -j DNAT --to-destination
iptables -A FORWARD -p tcp -d --dport 80 -j ACCEPT

So, question is: can we have port mapping from both PC1 and PC2 regardless of gateway settings on PC3?

Thank you in advance.

  • What does "map port 80 from PC1 and PC2 to PC3" mean? Jul 1 '12 at 11:02
  • I mean port 80 forward inside local network
    – Anton
    Jul 1 '12 at 11:11
  • I still don't get it. Are you saying that when people connect to or, you want to actually connect them to Jul 1 '12 at 11:22
  • PC1 and PC2 are both connected to internet and have external IP ( and, otherside both PC1 and PC2 are connected to local network ( and Also inside local network there is PC3 ( - web server. So I want to all incoming HTTP requests to any of external IPs (PC1 or PC2 were redirected to PC3 (
    – Anton
    Jul 1 '12 at 11:25
  • How are you doing iptables port forwarding exactly? If you're doing it correctly, the source IP address as seen by PC3 should be an address assigned to PC1 or PC2, so the gateway shouldn't matter. Jul 1 '12 at 11:29

You've only rewritten the destination.

You need to change the source address to be from PC1 or PC2, so the reply packets can also be NATted. And you need to change the destination address so that the packet will go to PC3. Rewriting both the source and the destination is called "dual NAT".

You need to do the DNAT in the PREROUTING chain and the SNAT in the POSTROUTING chain. Like this (for PC1):

iptables -t nat -A PREROUTING -p tcp -m tcp -d --dport 80 -j DNAT \
iptables -t nat -A POSTROUTING -p tcp -m tcp -d --dport 80 \
   -j SNAT --to-source
  • David, it is just what I need. I have tried to make similar rule, but can't do it myself. Thanks!
    – Anton
    Jul 1 '12 at 11:55
  • David, one more question: now in apache i see only 172.16.0.x IP instead of real client's IP. Without SNAT using default gateway I see real IP... What should I configure to see real IP?
    – Anton
    Jul 1 '12 at 13:50
  • You can't. You have to change the source address to be the NAT device's source address, so you can't provide the "real" source address to the server. If you need that, you can't use NAT and have to use something like a reverse proxy instead. Jul 1 '12 at 14:20

Give PC3 another IP address and use DNAT rules in PC1 and PC2 to the different IP addresses of PC3.

On PC3 use "ip rule" to route by source IP address, as shown by: http://lartc.org/howto/lartc.rpdb.multiple-links.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.