# add fwd 127.0.0.1,3128 tcp from internalnet to not me dst-port 80 via internalif # becomes... iptables -t nat -A PREROUTING -p tcp -i eth0 -d 192.168.91 --dport 3128 -j DNAT --to 192.168.0.1:80 iptables -A FORWARD -p tcp -i eth0 -d 192.168.0.1 --dport 80 -j ACCEPT # where .91 is the proxy and .1 is the gw