Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have enabled network forwarding on ip say on eth0. I am running KVM on say and a vm is running on it with its display on port 5902. I can access the display if i connect directly to using vinagre or vncviewer. But i want to access it through, that any connection coming on ranging in ports between 5900:6000 to be forwarded to ranging 5900:6000.

I am new to networking and have tried to do this using iptables but could not help myself.

Any advise would be very helpful Thanks in advance

share|improve this question

1 Answer 1

To map an individual destination port NAT you would use the following command:

iptables -t nat -A PREROUTING  -p tcp -m tcp   -d  --dport 5900 -j DNAT --to-destination

You should be able to NAT the whole range of ports by using the following command:

iptables -t nat -A PREROUTING -p tcp -m tcp -d --dport 5900:6000 -j DNAT --to-destination

Depending on your other rules you may also need an outbound filter rule allowing the post-NAT traffic to

iptables -A OUTPUT -p tcp -m tcp -d --dport 5900:500 -j ACCEPT

There are a couple of things that make your environment a bit unusual. Since the real server ( and the NAT server ( are on the same network you will need to traffic from the real server to so that the NAT mapping is maintained for return traffic.

You should make sure that ICMP redirects are disabled on the NAT server ( as well. This is set in the /etc/sysctl.conf file. To disable ICMP redirects on all interfaces make sure the following value is set to 1.

net.ipv4.conf.all.send_redirects = 1

Let me know if that works for you.

share|improve this answer
Mike thanks for the response. I tried the above but still i am unable to connect from outside or even same network. Is there anything that we can do to trace the connection, like where is the fault. –  Jatin Kumar Jan 26 '11 at 8:54
Have you looked at the /var/log/messages on to see if there is any indication if the traffic is being dropped? I would try running tcpdump on this system to look at the traffic coming in and out of the server. You can also run tcpdump on the server to see what traffic if any is arriving. –  Mike H. Jan 27 '11 at 4:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.