Forward a port to another server using iptables

Question

I have a server that is configured to block any port, and exceptions are configured like this (for mongo):

iptables            -A INPUT        -p tcp  --dport 27017       -s 10.20.1.0/8 -j ACCEPT

Now I want to expose a port to the public, but also have it forward to another server (Team Fortress server)

I tried this:

iptables -t nat -A PREROUTING -p tcp -i modem --dport 27015 -j DNAT --to-destination 10.20.1.133:27015
iptables -A FORWARD -p tcp -d 10.20.1.133 --dport 27015 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

But I'm still getting connection refused messages.

I guess the forwarding is set up, but the external connection is still being blocked. Any idea how I can solve that?

Answer 1

The following will necessarily have some redundant steps. They're there just to be extra sure ie. wear belt and suspenders.

# enable ip forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
# create a port redirection rule
iptables -t nat -A PREROUTING -p tcp --dport 27017 \
   -j DNAT --to-destination 192.168.0.69:27015
# create a masquerade rule in order to return packets
iptables -t nat -A POSTROUTING -p tcp --dport 27015 -j MASQUERADE

This is nothing more than a write-out (with complete commands) from comments above.