Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want connections coming in on ppp0 on port 8001 to route to on eth0 on port 8080

I've got these two rules

-A PREROUTING  -p tcp -m tcp --dport 8001 -j DNAT --to-destination

-A FORWARD -m state -p tcp -d --dport 8080 --state NEW,ESTABLISHED,RELATED -j ACCEPT

and it doesn't work, what am I missing?

share|improve this question

migrated from May 11 '10 at 12:55

This question came from our site for professional and enthusiast programmers.

NAT HOWTO – Paul Tomblin Dec 5 '08 at 21:11
I'm going to go with the n-p-r tag (although this could be programming-related, though poorly phrased of course.) – Mihai Limbăşan Dec 5 '08 at 22:12
How about this: I'm a programmer trying to set up an environment so I can debug my server application in eclipse being called from the innernet. Close enough? – stu Dec 5 '08 at 22:30
Sure, that's what I meant by "poorly phrased"... Could you edit the question accordingly? – Mihai Limbăşan Dec 5 '08 at 23:19

4 Answers 4

up vote 48 down vote accepted

First of all - you should check if forwarding is allowed at all:

cat /proc/sys/net/ipv4/conf/ppp0/forwarding 
cat /proc/sys/net/ipv4/conf/eth0/forwarding 

If both returns 1 it's ok. If not do the following:

echo '1' | sudo tee /proc/sys/net/ipv4/conf/ppp0/forwarding
echo '1' | sudo tee /proc/sys/net/ipv4/conf/eth0/forwarding

Second thing - DNAT could be applied on nat table only. So, your rule should be extended by adding table specification as well (-t nat):

iptables -t nat -A PREROUTING -p tcp -i ppp0 --dport 8001 -j DNAT --to-destination
iptables -A FORWARD -p tcp -d --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Both rules are applied only to TCP traffic (if you want to alter UDP as well, you need to provide similar rules but with -p udp option set).

Last, but not least is routing configuration. Type:

ip route

and check if is among returned routing entries.

share|improve this answer
I personally prefer the sysctl syntax like sysctl net.ipv4.conf.eth0.forwarding=1 – Doud Sep 7 '12 at 21:10
How do I remove the incorrectly entered rule? – Nickolai Leschov Apr 13 '14 at 2:51
second line: "iptables -A FORWARD -p tcp -d --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT" is NOT required if you don't have firewall restrictions/security, which is the case with most of home LANs, otherwise be careful with -A, be cause it will add it AFTER restrictions/security and may not work (so check -I instead, that is adding IN FRONT of iptables rules) – THESorcerer Aug 28 '14 at 13:34

I think what you want is:

iptables -A FORWARD -m state -p tcp -d --dport 8080 --state 

iptables -t nat -A PREROUTING -p tcp --dport 8001 -j DNAT --to-destination
share|improve this answer
ummm... that IS what I have already. I use iptables-restore to load it so each is in its own section, but that's what I wrote above. – stu Dec 5 '08 at 22:21
Okay, the syntax looked bad in the original. Did you try -i ppp0 in the rules? What is the problem exactly? – Robert Gamble Dec 5 '08 at 23:17

You forget postrouting source address SNAT 'ing:

sysctl net.ipv4.ip_forward=1
-A PREROUTING  -p tcp -m tcp -d $yours_wan_ip --dport 8001 -j DNAT --to-destination

-A FORWARD -m state -p tcp -d --dport 8080 --state NEW,ESTABLISHED,RELATED -j ACCEPT

-A POSTROUTING -p tcp -m tcp -s --sport 8080 -j SNAT --to-source $yours_wan_ip

And don't forget to set your linux firewall as default gateway on computer with address.

share|improve this answer


echo "1" > /proc/sys/net/ipv4/conf/ppp0/forwarding
echo "1" > /proc/sys/net/ipv4/conf/eth0/forwarding

These files tell the kernel it's allowed to forward packets between the interfaces.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.