I don't know exactly what you are trying, but do note that TPROXY is not the same as REDIRECT in short: The application on port 8080 must understand tproxy. see http://www.mjmwired.net/kernel/Documentation/networking/tproxy.txt the nice thing about tproxy is that for both sites the ip/port combinations do not change. (If you use squid with tproxy, you will see the public ipv6 address of the client in the logs of the webserver) If all that you want to do is running some application as unprivileged user listening on port 80, you can also grant your application to bind on ports < 1024 then, your "/path/to/your/app" will be allowed to bind on ports lower than 80, even if you do not run it as root.