having some trouble with iptables I'm trying to use my linode to forward traffic on a certain port to a different address, to test I had it forward to my computer here at home and I ran etheral.

iptables -t nat -A PREROUTING -p tcp -d --dport 2106 -j DNAT --to

I'm watching the packet get sent to the server, but I never see it forwarded back to me . . . any ideas?

2 Replies

lol nevermind, forgot the

iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Yes, you must do 3 things to properly map ports to another address using only one network interface (DNAT on the same interface), that is when you only have one interface on the iptables machine:

  • change the destination IP inside each packet before routing to the end machine's IP

  • change the source IP in each packet after routing to the iptables machine's IP (so that the end machine will return the IP to the iptables machine, and not the initial one)

  • enable IP forwarding on the iptables machine

Here's the complete command set, considering that is the iptables machine:

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 2106 -j DNAT --to-destination

iptables -t nat -A POSTROUTING -s ! -d -j SNAT --to-source

echo 1 > /proc/sys/net/ipv4/ip_forward

The first line says: all packets that enter the iptables machine on port 2106 of any IP on the iptables machine (you can restrict this to only one IP if you want) are to go to port 2106

The second line say: all packets that leave the iptables machine and that have a source IP address diffferent from the iptables machine's IP are to be changed to the iptables machine IP. If you don't do this then the end machine at will simply reply to the initial machine and not the iptables machine and the packet will get dropped/rejected.

The last two lines enable IP forwarding on the interfaces of the iptables machine. Without that nothing works. To have ip forwarding enabled after reboot you need to edit some /etc conf files. For debian it's /etc/network/options (set ipforward=yes), for redhat it's /etc/sysconfig/network (set FORWARDIPV4=true), for gentoo it's /etc/sysctl.conf (set net.ipv4.ip_forward=1), google for other Distros :P

If you want more details and explanations: http://www.idallen.com/oclug/2004_nat/dnat.txt


Please enter an answer

You can mention users to notify them: @username

You can use Markdown to format your question. For more examples see the Markdown Cheatsheet.

> I’m a blockquote.

I’m a blockquote.

[I'm a link] (https://www.google.com)

I'm a link

**I am bold** I am bold

*I am italicized* I am italicized

Community Code of Conduct