Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a computer A on the DMZ and I would like to route everything that goes to port 5555 to computer B (192.168.1.10) on port 6666. I enabled net.ipv4.ip_forward = 1 in sysctl.conf and setup the following iptables rules:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 5555 -j DNAT --to-destination 192.168.1.10:6666
iptables -t nat -A POSTROUTING -j MASQUERADE

But that isn't working, any ideas on what I could be missing? Here's my iptables config.

# Generated by iptables-save v1.4.9 on Sat Oct 23 19:25:17 2010                            
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [191:16773]
:TCP - [0:0]
:UDP - [0:0]
-A INPUT -s 127.0.0.0/8 -i eth0 -j DROP 
-A INPUT -i lo -j ACCEPT 
-A INPUT -m state --state INVALID -j DROP 
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
-A INPUT -p icmp -m icmp --icmp-type 8 -m state --state NEW -j ACCEPT 
-A INPUT -p udp -m state --state NEW -j UDP 
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j TCP 
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable 
-A INPUT -p tcp -j REJECT --reject-with tcp-reset 
-A INPUT -j REJECT --reject-with icmp-proto-unreachable 
-A TCP -p tcp -m tcp --dport 5555 -j ACCEPT 
COMMIT
# Completed on Sat Oct 23 19:25:17 2010
# Generated by iptables-save v1.4.9 on Sat Oct 23 19:25:17 2010
*nat
:PREROUTING ACCEPT [491:165229]
:OUTPUT ACCEPT [17:2012]
:POSTROUTING ACCEPT [17:2012]
COMMIT
# Completed on Sat Oct 23 19:25:17 2010
share|improve this question

1 Answer 1

You have your FORWARD policy in the filter table set to DROP.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.