Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way I can map to (with iptables? That is, all connections to localhost:3389 will be redirected to my LAN machine?

The reason for that is as follows: my iPhone RDP app can do SSH tunneling but does not provide options to tweak SSH parameters. So, it connects to my router via SSH, establishes a tunnel to and then tries to connect to localhost:3389 on the iPhone. Fail.

I don't want to run SSH server on my LAN machine and instead want to use router's SSH server(Asus RT-N16 running Tomato). Is that doable? This doesn't work:

$ iptables -t nat -A OUTPUT -p tcp -d --dport 3389 -j DNAT --to-destination
share|improve this question

Have a look at rinetd it seems to do what you want. There is some more information on installation and usage here.

share|improve this answer
Thanks, I'll check it out! – Mark L. Sep 25 '10 at 12:18
Thanks, rinetd looks promising for the fabled redirect from localhost to alternative host address. – Jay Taylor Jul 10 '13 at 18:50

There are some mistakes in your iptables command:

1) you are trying to catch that in the OUTPUT table, but for a redirection like this you need to do it in PREROUTING

2) you are not redirecting to the port too. you are just telling iptables to send those packets to a certain IP without specifing the port.

So your command should look like this:

iptables -t nat -A PREROUTING -d -p tcp --dport 3389 -j DNAT --to

My iptables-fu might be a bit rusty so you if it doesn't work try running the same command in the INPUT table too (-A INPUT). If nothing works, shout back here and we will find a fix.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.