Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm almost desperate... I've been reading for about 2 days iptables forwarding examples and I cannot do a simple port forwarding. I got 2 machines on different networks. server1 (S1 with ip is at my house and server2 (s2 with ip is at Amazon EC2.

I need to forward all the traffic that goes to s2 to s1. I tried this:

flushing all rules, activate kernel parameter to forward, add a postrouting and prerouting rule

iptables -F -t nat
iptables -F
echo 1 > /proc/sys/net/ipv4/ip_forward 
iptables -t nat -A POSTROUTING -d -j MASQUERADE
iptables -t nat -A PREROUTING -i eth0 -d -p tcp --dport 80 -j DNAT --to

optionally i also added:

iptables -A FORWARD -p tcp -i eth0 -d --dport 80 -j ACCEPT

Then i tried:

telnet 80

But didn't work. Why the hell this isnt working?

UPDATE: take a look at some tests:

[root@ip-10-234-141-216 ~]# telnet 80
Connected to
Escape character is '^]'.
[root@ip-10-234-141-216 ~]# iptables -F -t nat
[root@ip-10-234-141-216 ~]# iptables -F
[root@ip-10-234-141-216 ~]# echo 1 > /proc/sys/net/ipv4/ip_forward 
[root@ip-10-234-141-216 ~]# /sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -d --dport 80 -j DNAT --to-destination
[root@ip-10-234-141-226 ~]# /sbin/iptables -t nat -A POSTROUTING -j MASQUERADE
[root@ip-10-234-141-216 ~]# /sbin/iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT
[root@ip-10-234-141-216 ~]# 
[root@ip-10-234-141-216 ~]# telnet 80
telnet: connect to address Connection refused

UPDATE 2 route output:

[root@ip-10-234-141-216 ~]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface   U     0      0        0 eth0     U     1002   0        0 eth0         UG    0      0        0 eth0
share|improve this question

migrated from stackoverflow.com Dec 19 '11 at 16:02

This question came from our site for professional and enthusiast programmers.

I'm not much of a system administrator, but for what its worth, have you considered firing up wireshark? You might be able to figure out exactly --where-- your packets are being dropped? –  user1106176 Dec 19 '11 at 15:24
iptables itself does not forward—that is taken care of by the routing engine instead. Don't confuse that with NAT, either. –  jørgensen Dec 19 '11 at 15:37
Why are you trying to do this? Why not set up a reverse proxy on the amazon host? Or something that does an http redirect? –  Zoredache Dec 19 '11 at 16:18
@jørgensen iptables can do forwarding. That being said, it might not be the best solution as Zoredache suggested but perhaps OP does not have any choice. –  Belmin Fernandez Dec 19 '11 at 16:37
The kind of traffic I am trying to forward is not http traffic. so i guess a reverse proxy will not work. –  Fakada Dec 19 '11 at 16:41

5 Answers 5

up vote 2 down vote accepted

If you just need to redirect all incoming traffic to a specified port forwarded to your another machine try rinetd instead of iptables. It's a traffic redirection server.

share|improve this answer
Awesome! Works perfectly cause I only want to redirect traffic :) at least the connection is made and I get the reply :) –  Fakada Dec 20 '11 at 11:11
Big negative for rinetd version 0.62: the pid file is never created in /var/run/rinetd.pid, even if I add a pidlogfile statement to the config file. I strace the startup of it, and I never see it creating the file. –  e40 Aug 3 '13 at 20:31
NOTE: this is for the RPM I found in the Nux Misc repo. Building from source doesn't have this problem, even though both are supposed to be 0.62. –  e40 Aug 3 '13 at 21:21

I am currently having the same issue. I have resolved it by

echo 1 >| /proc/sys/net/ipv4/ip_forward
iptables -t nat -A  PREROUTING -p tcp -d --dport 8081 -j DNAT --to
iptables -t nat  -A POSTROUTING -j MASQUERADE
share|improve this answer

it will not work because you telnet from the same router machine It should working properly from any machine that use this route machine as a next hope or if you need just to make those work you can add this rule

/sbin/iptables -t nat -A OUTPUT -i eth0 -p tcp -d --dport 80 -j DNAT --to-destination
share|improve this answer
Doesn't work: iptables v1.4.7: Can't use -i with OUTPUT –  e40 Aug 3 '13 at 20:30

Your rules look good to me except that you are using --to instead of --to-destination. Might be that you are using a different version of iptables but according to man 8 iptables (v.1.4.7):

   --to offset
          Set the offset from which it starts looking for any matching. If not passed, default is the packet size.

Then in the DNAT section:

   --to-destination [ipaddr][-ipaddr][:port[-port]]
          which can specify a single new destination IP address, an inclusive range of IP addresses, and optionally, a port range  (which  is  only
          valid  if the rule also specifies -p tcp or -p udp).  If no port range is specified, then the destination port will never be modified. If
          no IP address is specified then only the destination port will be modified.

          In Kernels up to 2.6.10 you can add several --to-destination options. For those  kernels,  if  you  specify  more  than  one  destination
          address, either via an address range or multiple --to-destination options, a simple round-robin (one after another in cycle) load balanc-
          ing takes place between these addresses.  Later Kernels (>= 2.6.11-rc1) don’t have the ability to NAT to multiple ranges anymore.

This is what I would try:

/sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -d --dport 80 -j DNAT --to-destination
/sbin/iptables -t nat -A POSTROUTING -j MASQUERADE
/sbin/iptables -A FORWARD -i eth0 -p tcp --dport 80 -j ACCEPT

I'd also try to telnet to your destination from just to make sure that a firewall there is not preventing the connection.

telnet 80
share|improve this answer
telnet works ok from s2 to s1 –  Fakada Dec 19 '11 at 16:42
Did you man iptables to confirm the switches? I added the way I'd do the rules. Of course, make sure you iptables -F -t nat as you were doing before and also iptables -L FORWARD to make sure nothing supersedes the FORWARD rule. –  Belmin Fernandez Dec 19 '11 at 16:55
take a look at my update please. Did you tried to do that on your machine? Thanks anyway –  Fakada Dec 19 '11 at 21:12
Yuppers. Verified on my machine and it worked. –  Belmin Fernandez Dec 19 '11 at 21:41
really? what the hell :( what OS distribution are you using? –  Fakada Dec 19 '11 at 23:31

Why not just use iptables?

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 3306 -j DNAT --to

One off jobs:

iptables -t nat -A POSTROUTING -j MASQUERADE
echo "1" > /proc/sys/net/ipv4/ip_forward
sysctl net.ipv4.ip_forward=1
share|improve this answer

protected by Tom O'Connor Jun 5 at 10:58

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.