Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to setup Wake-on-Lan for some of the LAN computers at home and it seems that I need to open a UDP port (7 or 9 being the most common) and forward all requests to the broadcast IP, which in my case is

The problem is that my router does not allow me to forward anything to the broadcast IP.

I can connect to my router through telnet and it seems this router uses IPTABLES, but I don't know much about it or how to is.

Can someone help me out with the proper iptables commands to do what I want? Also, in case it doesn't work, the commands to put everything back would be nice too.

One last thing, rebooting the router will keep those manually added iptables entries or I would need to run them every time?

share|improve this question
A very similar question about Wake-on-Lan was asked fairly recently: How to get Wake-on-LAN working? The questioner's circumstances seem to be similar to yours, so the discussion there should be useful. – Steven Monday Nov 7 '10 at 1:07
# iptables -A PREROUTING -t nat -p udp --dport 6  -d <original destination> -j DNAT --to-destination

That will take a WOL packet destined for and reroute it to the broadcast of your network.

Also if you are using a Red Hat derived system you will need to save the iptables entry using

# service iptables save
share|improve this answer
When I do that iptables command and then try to list all rules with `iptables --list", that doesn't appear. – Ricardo Amaral May 8 '11 at 12:55
NAT rules are in the mangle table # iptables -t mangle -nL – Red Tux May 8 '11 at 15:40
why --dport 6 rather then 9 (or 7) as sepcified in the question? – Jack Douglas Apr 3 '15 at 16:55

Add something like this:

iptables -A IN_FILTER -p udp -d -j ACCEPT -m comment --comment "Depicus WoL" will give you the syntax

Should survive a reboot but you never can tell until you try it.

share|improve this answer
Shouldn't the port be specified too? – Ricardo Amaral Nov 6 '10 at 23:54
Sorry was late at night. Yes -dport 7 and -sport 7 to set the destination port and source port. – Depicus Nov 7 '10 at 12:39
Your -A might not be IN_FILTER so do a iptables -L to get a list of rules. – Depicus Nov 8 '10 at 13:52
There's a bunch of them, how do I know which one should I use? I saw in the documentation that -A is for append, what if I used -I to insert a rule for IN_FILTER? Not the same? – Ricardo Amaral Nov 8 '10 at 19:53
No you cannot add your own, the router would not know where to get them from. Best bet is to add a firewall rule similar to what you want in the web interface, just make it up. Then you can telnet in and see what section the new rule is in. – Depicus Nov 8 '10 at 20:50

There's a great solution using the tool socat, mentionned on this StackExchange topic:

Transform a UDP unicast packet into a broadcast?

I'm not an expert at all on this topic, so I can't elaborate, I can only quote. This solution worked great for me.

The solution mentioned by Red Tux ( doesn't work, iptables is not made to broadcast a packet. This is explained in the StackExchange topic I mentioned above.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.