Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i constructed a nat with iptables, as following:

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -I PREROUTING -p tcp --dport 9000 -j DNAT --to xx.xx.xx.xx
iptables -t nat -I POSTROUTING -p tcp --dport 9000 -j MASQUERADE
service iptables save
service iptables restart

the configuration worked fine, but there was a problem when i disconnected and tried to reconnect again, connection will be refused within about 2~3 minutes, after that, things go fine again.

what was the problem? how do i make it to accept new connection after the old one break?

share|improve this question
problem solved: turn of tcp_tw_recycle in kernel parameter to solve the problem – xpu Nov 14 '11 at 14:44

Are you sure this is about iptables and not about the xx.xx.xx.xx server your rules are forwarding the traffic? Does the xx.xx.xx.xx reply to you during that 2-3 time window if you attempt to connect it directly?

I suspect you need to do something at your destination server and not the iptables rules. See the server logs, and see if whatever application is listening at xx.xx.xx.xx did spit out something there for you to read.

share|improve this answer
yes, i'm positively sure that the backend server is up and running, and actively responding to direct connection. AFAIK, the connection to the front server was refused when i tried to reconnect, the connection never made it to the backend server. and the front server even unable to accept other connections from another client, which means the whole service was dead for about 2~3 minutes. – xpu Nov 14 '11 at 9:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.