up vote 3 down vote favorite
share [g+] share [fb]

Is it possible to redirect incoming traffic on a specific port of my Ubuntu Linux server machine to another server (that has another public IP address and is located at another site)? I'm running a gameserver on the other server but I want people to be able to connect to the old IP address. Could this be done with some kind of NAT/PAT combined with VPN, perhaps?

This is my testing results with the iptables rules...

root@oldserver:~# tcpdump -n -i eth0 port 83
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
17:47:40.349492 IP client.63633 > oldserver.83: Flags [S], seq 783927589, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
17:47:40.597801 IP client.63634 > oldserver.83: Flags [S], seq 924277477, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
17:47:43.349118 IP client.63633 > oldserver.83: Flags [S], seq 783927589, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
17:47:43.596024 IP client.63634 > oldserver.83: Flags [S], seq 924277477, win 8192, options [mss 1460,nop,wscale 2,nop,nop,sackOK], length 0
17:47:49.349400 IP client.63633 > oldserver.83: Flags [S], seq 783927589, win 8192, options [mss 1460,nop,nop,sackOK], length 0
17:47:49.600172 IP client.63634 > oldserver.83: Flags [S], seq 924277477, win 8192, options [mss 1460,nop,nop,sackOK], length 0
link|improve this question
feedback

1 Answer

up vote 2 down vote accepted

These two lines

iptables -t nat -A PREROUTING -p tcp --dport <yourgameserverport> -j DNAT --to <yournewserver>:<yournewport>

iptables -t nat -A POSTROUTING -p tcp -d <yournewserver> --dport <yournewport> -j MASQUERADE

should

  • redirect the traffic to the new server (no need for a VPN if it is public traffic anyway)
  • disguise the redirected packets as originating from your "old" server so it surely would be in the routing path to reverse-map the response packets of the forwarded connecions.

See the respective man page sections of iptables for details on the DNAT and MASQUERADE targets.

Note that this kind of redirection is simple to set up but would break your IP logging at the destination server - every forwarded connection would show up as originating from <youroldserver>. As long as this is just a transition solution, it should work out. If you want to do it permanently, you might look into tunneling the forwarded requests through a virtual interface (e.g. a VPN) and ensuring that your forwarding host <youroldserver> is in the response packet's routing path by routing the responses back out through the same virtual interface using alternate routing tables.

Ah, and you would need to enable routing by issuing echo "1" > /proc/sys/net/ipv4/ip_forward (for a temporary change) or editing /etc/sysctl.cfg and setting net.ipv4.ip_forward=1 (effective after reboot).

link|improve this answer
The first command says iptables: No chain/target/match by that name. – dataviruset Jan 5 at 1:37
Sorry, corrected. – syneticon-dj Jan 5 at 1:48
The commands worked, but it doesn't work to make a connection to the port on the first server. – dataviruset Jan 5 at 3:07
This reminds me: does your game server use TCP at all? If it is using UDP, re-run the commands with the -p udp in order to make sure UDP packets are forwarded as well. In case it still does not work, please run tcpdump port <yourgameserverport> on <youroldserver> when trying connection setup and post the results to your question. – syneticon-dj Jan 5 at 10:45
I tested with TCP traffic to a web server first: iptables -t nat -A PREROUTING -p tcp --dport 83 -j DNAT --to newserver:80 iptables -t nat -A POSTROUTING -p tcp -d 80 --dport 80 -j MASQUERADE See my tcpdump above. – dataviruset Jan 5 at 16:52
show 2 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.