Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have three machines: A local PC (public IP, an Ubuntu 10 Server box in a datacentre (eth0 on public IP), and a third-party server hosting a website outside of my network (let's say Slashdot on

  • Using iptables, how do I access Slashdot from my local machine using ?
  • Would this process differ if Slashdot was on the same LAN as my Ubuntu box?
  • Can this be done with just NAT PREROUTING/POSTROUTING, or do I need MASQUERADE?
share|improve this question
up vote 7 down vote accepted
   PC ----- Ubuntu 10 Server ----- Slashdot 
(      (        (
  1. Enable the IP forwarding on Ubuntu:

    echo 1 > /proc/sys/net/ipv4/ip_forward

    and add the following rules:

    iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j DNAT \
    iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source
  2. No.

  3. You should use MASQUERADE if the Ubuntu has a dynamic IP:

    iptables -t nat -A POSTROUTING -j MASQUERADE

You can also use SSH local port forwarding in this case by executing the below command on the Ubuntu:

$ ssh -L -N user@

There's still another (or more) way to do this. Take a look at the rinetd:

Name       : rinetd
Arch       : i386
Version    : 0.62
Release    :
Size       : 41 k
Repo       : installed
Summary    : TCP redirection server
URL        :
License    : GPL
Description: rinetd is a daemon which redirects TCP connections from one IP address
           : and port to another IP address and port. This daemon is often used to
           : access services behind a firewall.

The configuration is very simple. Add the belows line into /etc/rinetd.conf: 8080 80

and start:

# /etc/init.d/rinetd start
Starting rinetd:                                           [  OK  ]

It will do everything for you.

share|improve this answer
Fantastic. The iptables version works like a charm. I was missing the POSTROUTING rule, and was getting nowhere. If anyone's trying to do this with a saved .conf file, this is what you're after: *nat -A PREROUTING -p tcp -m tcp -i eth0 --dport 8080 -j DNAT --to-destination -A POSTROUTING -o eth0 -j SNAT --to-source COMMIT – jetboy Nov 1 '11 at 13:25
Follow-up question here:… – jetboy Nov 1 '11 at 22:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.