Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are using Stunnel. But want to replace it is with an iptables entry if possible. need to be forwarded to So in iptables I set these two entries:

[root@dev ~]# iptables -t nat -A PREROUTING -p tcp --dport 7300 -j DNAT --to-destination
[root@dev ~]# iptables -A FORWARD -m state -p tcp -d --dport 7300 --state NEW,ESTABLISHED,RELATED -j ACCEPT

But it isn't working.

I did check that /proc/sys/net/ipv4/conf/eth0/forwarding has the value "1" inside.

Any tips or hints?

thanks, Patrick

share|improve this question
I'm guessing you're already aware that stunnel doesn't just re-route traffic, it wraps it in SSL - and iptables doesn't – symcbean Nov 25 '10 at 10:09

To enable IP forwarding, I usually change the value of /proc/sys/net/ipv4/ip_forward to 1.

To make it permanent, I uncomment the line: net.ipv4.ip_forward=1 in /etc/sysctl.conf.

You did not mention from where you are making your request.

Also, you need to be careful about choosing the correct chains (INPUT, FORWARD, PREROUTING, etc.). The INPUT chain is used to process the packets destined to the firewall itself. The OUTPUT chain is used for the packets originated from the firewall host. The FORWARD is used for those packets passing through the firewall.

At the end, tcpdump is your friend when you are not sure which firewall rule is not working. You can trace the traffic coming and going out of your firewall.

share|improve this answer
[root@dev ~]# cat /proc/sys/net/ipv4/ip_forward 1 that is there also yes – Patrick van Hout Nov 25 '10 at 8:29

have you add Masquerade ?

iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.