A sandbox enviroment of a web app is reachable directly by an IP address: http://<my_ip_address> without a login name.

Is there a way to make a virtual host in my local machine, named as <my_ip_address>, and change /etc/hosts so it will "redirect" to my localhost? <my_ip_address>

So when I load the url http://<my_ip_address> the browser will point to my localhost? The way I can already redirect domain names.

1 Answer 1


Hosts file can only be used to associate a domain name with an IP; it cannot map IP to IP.

Altering IPs can be done by a firewall. On Linux, the default firewall is controlled by iptables commands. "man iptables" is the documentation. Google "explain iptables" for introductory explanations.

Some links:




Specifically, you want to change OUTGOING requests from your PC to an IP address (<my_ip_address>), so that they instead go to a different IP address, in this case You want to perform NAT (Network Address Translation), given the "destination IP" (<my_ip_address>; e.g., changing it to a different "destination IP" (

Try this (in place of, put the ip_address that needs to be altered):

iptables -t nat -A OUTPUT -p all -d -j DNAT --to-destination


-t nat = table for translating one address to another

-A OUTPUT = append to the list of rules for locally-generated, outgoing, packets. SECURITY WARNING: Make sure the rule includes this OUTPUT directive. If you don't, the rule would create a possible security hole, because matching Incoming packets from remote locations would also be directed to localhost.

-p all = apply to all protocols (tcp, udp, and icmp).

-d = the original IP address that the packet was going to (its destination).

-j DNAT = if the rule matches (in this case, if an outgoing packet has destination IP, then handle it with DNAT, which alters the destination.

--to-destination = tells DNAT what to do; replace the original destination with "".

(NOTE: If you had a more complex situation, such as intercepting requests for specific web pages, an alternative solution might be to use "proxy" software.)

  • Note that there is a security concern here. is commonly understood to be unreachable from any remote host. If you change that without adding filtering, you may unintentionally defeat a security measure. Mar 22, 2014 at 21:23
  • @Slartibartfast - Note that we only change OUTGOING requests. And we are making the change in a firewall on this PC. (Some requests, that would have gone out to an external site, we are looping back to ourself.) This does not change INCOMING requests, so it does not effect what anyone remote can see/do. Given this, do you still see a security concern? Mar 3, 2017 at 7:41
  • 2
    ... the essential safety measure, is the inclusion of "-A OUTPUT" in the rule. Per your comment, people need to be aware that OMITTING that would have the danger you describe. I will add a comment to emphasize this. Mar 3, 2017 at 7:48
  • 3
    It is working fine but i can't see it listed anywhere iptables --list or --list-rules. How can i list it and delete it afterwards when no longer needed? Mar 14, 2017 at 8:17
  • 1
    @FilipStefanov (Bit late I know!): List the nat rules with a number next to them: iptables -t nat --list --line-numbers Then delete which never rule by that number: iptables -t nat -D OUTPUT <number> Feb 8, 2019 at 10:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .