Home / server / Questions / 141872
In Process
Kevin Campion
Asked: 2010-05-15 05:00:07 +0800 CST

iptables prerouting to redirect source ip address on ethernet

  • 772

I have 2 ip adresses on the Internet who redirect on the same machine. On this machine, one Debian runs on OpenVZ. I can set iptables rules to redirect all http request to the Debian.

    iptables prerouting -d ip_address_2 DNAT --to ip_address_local_1
                     +--------------+
                     |              |
                     |              V
                     |          10.10.101.5
I|                 +------+     +----------+
N|ip_address_1     |      |-----|Debian1 VE|-- Apache's log
T|-----------------|OpenVZ|     +----------+   [client ip_address_1]
E|              |  |      |
R|ip_address_2  |  |      |
N|--------------+  |      |
E|                 +------+
T|

Iptables' rules :

iptables -t nat -A PREROUTING -p tcp -i eth0 -d ip_address_2 --dport 80 -j DNAT --to 10.10.101.5:80
iptables -A FORWARD -p tcp -i eth0 -o venet0 -d 10.10.101.5 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -i venet0 -o eth0 -s 10.10.101.5 --sport 80 -j ACCEPT

When I go to webpage with "http://ip_address_2", I can see the good content but the ip address on access log file is ip_address_1, I would like to see my ISP's ip address.

If I type :

# iptables -t nat -L -n


Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  0.0.0.0/0            ip_address_2       tcp dpt:80 to:10.10.101.5:80 

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0           
SNAT       all  --  10.10.101.5           0.0.0.0/0           to:ip_address_2 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Any ideas?

iptables openvz route

1 Answers

  1. perhaps this is as simple as adding Listen ip.add.re.ss2:80 in your httpd configuration?

    and removing any Listen 80 directives, to make sure the server is only serving the IP address you want.

    i just re-read your iptables rules; you're sending traffic from ip2 on port 80 to ip1 on port 80... of course your logs are going to show ip1. you're redirecting the traffic before it hits the server.

    • 1