Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running cPanel/WHM with ConfigServer Firewall (csf).

I want to forward port 8080 on my webserver to an internal server with an IP of lets say thats running a webserver on port 80. How can I do this?

My WAN ip is running on eth0 The internal server is connected using the eth1 interface.

What would be the appropriate IPtables cmd to do this?

share|improve this question

migrated from Jul 12 '11 at 4:06

This question came from our site for professional and enthusiast programmers.

Dup of:… – Ward Jul 12 '11 at 5:07

Something like this should work

sudo /sbin/iptables -t nat -I PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination

If you haven't already done so you may need to enable IP forwarding too

/sbin/sysctl -w net.ipv4.ip_forward=1

and to make it permanent edit /etc/sysctl.conf and set

net.ipv4.ip_forward = 1


As the policy on your FORWARD chain is DROP you will need to allow packets through. I don't think your current FORWARD rule is doing anything helpful so delete it.

Enable packets sent to FORWARD from eth0:8080 to be sent to

/sbin/iptables -I FORWARD  -p tcp -m tcp  -d --destination-port 80 -j ACCEPT

Allow packets to go the other way too

/sbin/iptables -I FORWARD -i eth1 -p tcp -m tcp -j ACCEPT

You mat want to restrict the latter further.

share|improve this answer
Will that actually working considering the ip is on eth1? – William Balkcom Jul 11 '11 at 22:37
Didn't seem to work. – William Balkcom Jul 12 '11 at 0:00
@WilliamBalkcom: yes, you are routing packets from eth0:8080 -> or at leasts that's what you requests. This works on a test system I have. Check that you have something listening on Is running a firewall and is it allowing connections on port 80 ? Check that your FORWARD chain is allowing packets. – Iain Jul 12 '11 at 6:55
I have a webserver listening on, it is allowing all connections. The connection to is established through eth1 and eth1 is configured like this: And actually the IP is, just using as an example. – William Balkcom Jul 12 '11 at 7:11
@WilliamBalkcom: please post the (suitably redacted) output of iptables -l -v -n and iptables -t nat -L -v -n – Iain Jul 12 '11 at 8:29

Something like:

iptables -A PREROUTING -t nat -i eth1 -p tcp \ 
  --dport 8888 -j DNAT --to

Sends forwards the requests on port 8888.

iptables -A INPUT -p tcp -m state --state NEW --dport 8888 -i eth1 -j ACCEPT

Allows incoming connections ton port 8888.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.