Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a postgresql instance running on SLES.

I want to set it up to listen on localhost, and enable iptables to perform port forwarding.

My current configuration


listen_addresses = 'localhost'
port = 5432


local   all         all                               md5
host    all         all          md5
host    all         all          md5

iptables (rule added via iptables -t nat -I PREROUTING -p tcp --dport 5432 -j REDIRECT):

Chain PREROUTING (policy ACCEPT 441 packets, 54049 bytes)
 pkts bytes target     prot opt in     out     source               destination
    6   420 REDIRECT   tcp  --  *      *             tcp dpt:5432

Configured like this, I am not able to open a psql connection to the DB.

Without the iptables rule, I get a Connection refused error.

With the iptables rule I get a Connection timed out error.

share|improve this question
Why do you want to use port forwarding? Can't you just have postgres listen on the ethernet interface? – Kyle Smith Jun 21 '11 at 10:43
nice question!! – Erdinc Ay Jul 13 at 21:31

You may need to check the filter table. For example, what is the default policy for INPUT? Do you have an explicit rule to allow port 5432 if not allowed by CHAIN policy.

Also, it may not be enough to write the rule as shown in your question. Read this from the man iptables:

    This target is only valid in the nat table, in the PREROUTING and OUTPUT
    chains, and user-defined chains which are only called from those chains. 
    It redirects the packet to the machine itself by changing the destination IP
    to the primary address of the incoming interface (locally-generated packets are mapped to  the address).

So, it will redirect the request to an IP address not necessarily localhost or You may need to add the IP address explicitly in the NAT rule. You can try:

iptables -t nat -I PREROUTING -p tcp --dport 5432 -j DNAT --to-destination
share|improve this answer
I added the DNAT rule, but this has not changed the results. – David Resnick Jun 19 '11 at 12:33
Can you show us your iptables rules in the NAT and filter tables? You can use the commands: iptables -L -n and iptables -L -n -t nat. – Khaled Jun 20 '11 at 7:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.