Take the 2-minute tour ×

I have a xen machine (DomU) hosting a few VMs.

One of the VMs is called router ( and is the only one of the machines supposed to be reachable from the outside.

There are other VMs which are going to recieve traffic, but it has to be filtered. Let's call one of these machines web (, as it serves a webpage.

Packets coming to web follow this routing path:

xen DomU -> router -> web

DomU's configuration:

-A PREROUTING -d <external_ip> -p tcp -m tcp --dport 80 -j DNAT --to-destination 

router's configuration:


Everything works as expected.

Port 80 from the external IP is routed via router all the way to web.

There is a problem tho:
web sees as the source for the connection, rather than the real client IP.

I guess this is caused by the fact that there are two DNATing iptables.

But why?

share|improve this question
add comment

2 Answers

up vote 2 down vote accepted

using MASQUERADE is for NATting a source address to a public IP; you should NOT masquerade traffic coming from the internet, which it seems you are likely doing.

Therefore, remove your MASQUERADE rules entirely or, if you need them to provide internet access to internal clients, restrict the MASQUERADE to a specific subnet

share|improve this answer
I've added changed the masquerade line to: -A POSTROUTING -o eth0 -s -j MASQUERADE so now it should only masquerdate traffic that should be routed from the internal subnet thru this machine. I thought -o eth0 was doing that, but the machine was routing all traffic thru eth0. Thanks :) –  Prody Sep 12 '11 at 9:30
add comment

I believe the MASQUERADE statement on "router" is, uh, masquerading the external IP as it comes through "router".

share|improve this answer
add comment

Your Answer


