DNAT to 127 fails

Jörg Harmuth harmuth at mnemon.de
Fri Aug 5 12:08:12 CEST 2005

Jan Engelhardt schrieb:
> Hi,
> Connection from anywhere-on-the-internet (dsl0) to alphagate:80 only does not 
> work when --to-dest is It works with
> (It's not a bridge problem, that for sure!)
> Why? Some routing problem?
> iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-dest

"-j DNAT" is not intended to DNAT to localhost. The REDIRECT target is
for this. From "man iptables":

       This  target  is  only  valid  in the nat table, in the
       PREROUTING and OUTPUT chains, and user-defined chains
       which are only called from those chains.  It redirects
       the packet to the machine itself  by  changing  the
       destination  IP  to  the  primary  address of the incoming
       interface (locally-generated packets are mapped to the
       address).  It takes one option:

       --to-ports port[-port]
              This specifies a destination port or range of ports to
              use: without this,  the  destination  port is never
              altered.  This is only valid if the rule also specifies
              -p tcp or -p udp.

Have a nice time,


More information about the netfilter mailing list