Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to set up port forwarding with iptables.

I've read several stuff (including here on serverfault) but every example I try fails.

I have a Debian GNU/Linux box with a globally routed IP address, say I also have an internal network, which has one host ( in it.

I simply want port 2200 on forwarded to, so this is what I've done:

iptables -A PREROUTING -t nat -p tcp --dport 2200 -j DNAT --to
iptables -A INPUT -p tcp -m state --state NEW --dport 2200 -j ACCEPT

However, this does not work. If i try to ssh to, I get "Connection refused".

Trying for over 3hrs now and I'm feeling like I've tried everything and there must be something wrong.

IP forwarding is on:

root@ cat /proc/sys/net/ipv4/ip_forward
share|improve this question
Is that your entire ruleset? You also need to allow ESTABLISHED,RELATED packets, otherwise only the first packet of the TCP handshake will ever make it through. – Ansgar Wiechers Sep 10 '12 at 17:46
Your description of your network is a bit confusing. The address is not within the network. What is the address of the inside interface of the firewall? – Zoredache Sep 10 '12 at 18:28
Zoredache: Sorry. I meant, not – Daniel Sep 10 '12 at 18:36

A couple things.

First since the destination nat is performed on the PREROUTING you need to make sure you build any of your rules on the filter table using the address after the address translation has been performed. PREROUTING is processes before the FILTER table. So you rule that permits 2200 isn't doing anything useful since since it doesn't have a destination port of 2200 by when it hits the filter table, and instead it has been translated to port 22 by your NAT rule.

The other part I am less certain about since you haven't given a good description of your network. Unless I am miss-understanding your network setup, then I believe is not an address on the firewall. I bring this up since you are trying to add a rule to the INPUT chain. The INPUT chain is used for packets being sent to the firewall system itself, and doesn't get visited when the packets are being routed between interfaces from one network to another. I suspect that you should be adding a rule to the FORWARD chain instead.

share|improve this answer
For clarification, the network is a network I use on that host for virtual machines (KVM). And, the INPUT chain's default action is ACCEPT. Using tcpdump I'm able to see the SSH packet coming on the WAN interface – Daniel Sep 10 '12 at 18:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.