Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to forward trafic destined at port 100 to The actual goal is to forward to a different IP:PORT, but for the sake om just getting stuff to work I have a socket listening on *:100. From this site, and google "iptables port forwarding howto", I've been lead to belive the syntax is as follows, which is part of my ruleset.

#Set default policies to DROP

iptables -P INPUT DROP

iptables -P FORWARD DROP

iptables -P OUTPUT DROP

#Flush ruleset

iptables -F

iptables -t nat -F

iptables -t filter -F

#Allow local access

iptables -A INPUT -i lo -j ACCEPT

iptables -A OUTPUT -o lo -j ACCEPT


iptables -A INPUT -i eth0 -m sate --state ESTABLISHED,RELATED -j ACCEPT

iptables -A OUTPUT 1 -o eth0 -m state --state ESTABLISHED,RELATED -j ACCEPT

#Allow outbound SYN requests

iptables -A OUTPUT -o eth0 -m state --state NEW -j accept

#### The routing related

# Allow SYN requests for the port-to-be-forwarded

iptables -A INPUT -i $INET_IFACE -p tcp --dport 100 -m state --state NEW -j ACCEPT

# Route to

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 100 -j DNAT --to-destination

# Accept the forward

iptables -A FORWARD -t filter -i eth0 -p tcp --dport 101 -j ACCEPT

# Accept all related in forward

iptables -A FORWARD -t filter -i eth0 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT

My sysctl settings are:

# sysctl -p

net.ipv4.ip_forward = 1

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.all.rp_filter = 1

net.ipv4.tcp_syncookies = 1

net.ipv4.conf.all.accept_source_route = 0

net.ipv4.conf.default.accept_source_route = 0

net.ipv4.conf.all.accept_redirects = 0

net.ipv4.conf.default.accept_redirects = 0

net.ipv4.conf.all.secure_redirects = 0

net.ipv4.conf.default.secure_redirects = 0

net.ipv4.icmp_echo_ignore_broadcasts = 1

net.ipv4.conf.all.send_redirects = 0

net.ipv4.conf.default.send_redirects = 0

net.ipv4.conf.all.log_martians = 1

kernel.randomize_va_space = 1

# cat /proc/sys/net/ipv4/conf/eth0/forwarding


nmap states the port is closed for connect() and SYN scans, but open|filtered for FIN and Xmas scans.

What am I missing ?

share|improve this question
are you running nmap against localhost ( ? – Geraint Jones Aug 13 '10 at 7:47
No, I am running nmap against the IP of eth0 – Thomas Aug 13 '10 at 7:58
And if I allow SYN requests to port 101 nmap finds that port is open – Thomas Aug 13 '10 at 7:59
Can you consider wrapping your code in backticks (e.g. ``) or indenting it all by four spaces, just to make it easier to read? – PP. Aug 18 '10 at 7:55

3 Answers 3

Solution was partly based om wolfgansz. As I was not originally registered as a user on serverfault, and have since cleared my cookies, it doesnt seem that I can just post a comment.

Default policies are DROP for INPUT and OUTPUT chains, and ACCEPT for FORWARD.

function add_forward {
# $1 = title
# $2 = internal host
# $3 = external port
# $4 = internal port
if [  "$2" == "" ] || [ "$3" == "" ] || [ "$4" == "" ]; then
  echo Skipping forward $1
  echo "Forwarding port "$3" to "$2" port "$4" ("$1")"
  $IPT -t nat -A PREROUTING -p tcp --dst $MYIP --dport $3 -j DNAT --to-destination $2:$4
  $IPT -t nat -A POSTROUTING -p tcp --dst $2 --dport $4 -j SNAT --to-source $VMNETIP
  $IPT -t nat -A OUTPUT --dst $MYIP -p tcp --dport $3 -j DNAT --to-destination $2:$4

And finally to use it add_forward "My forward", "" 100 101

$MYIP is defined as the eth0 public IP $VMNETIP is the vmware NAT interface

So all in all, this enables incoming connections on eth0:100 to be bridged through vmnet nat interface to a virtual machine..

Hopefully, this can help someone else as well.

The primary tool for debugging was tcpdump on both the host and guest system

"tcpdump -i eth0 port 100" for listening on the host. This revealed a problem with me setting an incorrect IP in the POSTROUTING rule which made eth0 just drop the packets.

Thanks for the help.

share|improve this answer

Port forwarding only really makes sense from one ethernet interface to another. Therefore I would have to presume that $INET_FACE is not the same as eth0. For the purposes of what follows, I will assume it to be eth1.

In that case you need the following rules:

iptables -A INPUT -i eth1 -p tcp --dport 100 -m state --state NEW -j ACCEPT
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 100 -j DNAT --to-destination
iptables -A FORWARD -t filter -i eth1 -p tcp --dport 101 -j ACCEPT
iptables -A OUTPUT -t filter -o eth0 -p tcp --dport 101 -j ACCEPT

This opens the inward path. However, since your default policy is to drop packets that have no matching rule, you also need some rules for the return traffic.
I am not a friend of overcomplicating firewalls built with iptables, you can easily end up in a situation where you have a really hard time understanding what's going on. Therefore I would recommend to change the default policy to ACCEPT for the FORWARD chain, and control the traffic primarily through the INPUT chain and, if necessary, the OUTPUT chain.

If the above doesn't provide enough detail to move forward, just post a comment, and I can provide further pointers. There are some good diagrams on traffic flow through iptables, I particularly like this one and this one. These show which tables and chains are used, and should allow you to formulate your rules. Always remember, you need rules for both directions of traffic flow.

share|improve this answer
Actually, my incoming interface is eth0 and the one I attempt to forward to is vmnet8. I attempted to adobt your suggested rules, but failed. Therefore I changed the default policies to ACCEPT and added the following rules: iptables -t nat -A PREROUTIMG -i eth0 -p tcp --dport 100 -j DNAT --to-destination vmip:101 iptables -t FORWARD -j ACCEPT iptables -t OUTPUT -j ACCEPT But still no success. A syn request is received on vmnet8 and a syn,ack reply is sent. tcpdump does not see the reply on eth0 – Thomas Aug 13 '10 at 11:15

Are you trying to redirect traffic originating from your own machine ?

If so, you should also add a DNAT rule to the OUTPUT chain of the nat table. The PREROUTING chain will only process packets coming from other hosts.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.