Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup a simple port forwarding firewall and I can't make the basic non-firewall configuration to work. I have setup the iptables script as follows


# interfaces

# enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# delete all existing rules to start from scratch
iptables -F
iptables -t nat -F
iptables -t mangle -F
iptables -X

# accept everything
iptables -A INPUT -j ACCEPT
iptables -A FORWARD -j ACCEPT
iptables -A OUTPUT -j ACCEPT

# port forwarding to local machine
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j DNAT --to

# masquerade
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE

This script will not firewall anything but it should redirect port 80 on the gateway machine to my internal machine This is not working. The problem is that I can't get from the outside into the inside machine. I don't even know how to start debugging. Any hints on where to look?

share|improve this question
add comment

5 Answers


# port forwarding to local machine
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j DNAT --to


 # port forwarding to local machine
iptables -t nat -A PREROUTING -i $WAN -p tcp --dport 80 -j DNAT \
share|improve this answer
It doesn't need to include the ":80" in ""; it just needs to include "", since the port isn't changing. –  Kevin M Jun 17 '09 at 13:42
very true, but it's there for completeness.. :) –  rkthkr Jun 17 '09 at 13:45
Actually, --to -> --to-destination added nothing either. It's the same command. –  Thomas Jun 17 '09 at 14:02
add comment

Double-check with iptables -L -n -v --line, and with -t nat. What you did looks right to me. Also run tcpdump to see if you can see the TCP SYN och the outside (eth0) and on the inside (eth1) to make sure this is where it disappears.

"This is not working" is not a good description. What isn't working? Do you get timeout or connection refused?

share|improve this answer
You are right. This is what is hapenning. I can get from the outside to the inside and browse in my internal webserver (tomcat) for the first two pages. Once I need to enter login and password it just stops responding. I can browse from the internal pages without any problems. –  rmarimon Jun 17 '09 at 14:32
By the way, the pages after login timeout. –  rmarimon Jun 17 '09 at 14:35
Could it be because after logging in you are redirected to either https (port 443) or to the local (internal) ip address of the webserver? –  Thomas Jun 17 '09 at 14:51
Another symptom. If I make my internal machine use the gateway machine to move traffic out, I can traceroute to www.google.com from but I can't browse google because it just hangs waiting for a response. –  rmarimon Jun 17 '09 at 15:02
As for the redirection, when I replicate this setup with a linksys wireless router (I'm desperate) using it as a port router it works. This is what is leading me to believe that there is something wrong with my setup script. –  rmarimon Jun 17 '09 at 15:03
show 1 more comment

I don't know what version of iptables you're running, but under v1.3.5, you need to have --to-destination instead of --to.

share|improve this answer
add comment

I think your last line should be

# masquerade
iptables -t nat -A POSTROUTING -o $LAN -j MASQUERADE

Note LAN, not WAN.

share|improve this answer
The package needs to be "masqueraded" when it is going out on the wan... –  rkthkr Jun 17 '09 at 13:28
No, it's all right if the web server sees the actual IPs and if there are public IPs on the internal network. But the remote computer on the public Internet needs to see the public IP, not a private one. –  Kevin M Jun 17 '09 at 13:41
I guess you guys know better. :) –  Neobyte Jun 17 '09 at 14:21
add comment

I'm normally setting this up with IPs instead of interfaces. Please try the following:

# port forwarding to local machine
iptables -t nat -A PREROUTING -d $EXT_IP -p tcp --dport 80 -j DNAT --to

# masquerade
iptables -t nat -A POSTROUTING -s -j MASQUERADE

and set the $EXT_IP of course.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.