Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to forward port 2222 on an Ubuntu 12.04 server to remote host port 22, using iptables.

After reading many web pages on port-forwarding, I issue

$ sysctl net.ipv4.conf.eth0.forwarding
net.ipv4.conf.eth0.forwarding = 1
$ sudo iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 2222 -j DNAT --to-destination

Which forwards traffic as I desired. But ssh does not work. Turns out I needed to also supply

$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

And now it's good. I understand the above commands; what I don't understand is the plethora of sites giving the first command and none giving the second. Under what conditions would the first command suffice?

Note: Example site giving only the DNAT commmand.

share|improve this question
up vote 2 down vote accepted

The sites you are referring to are likely recommending DNAT in the context of using iptables on a router that connects an internal LAN to the public Internet. In this case, since all the traffic between the Internet and the internal LAN must flow through the iptables router, the returning packets are automagically rewritten for you as well.

In your configuration, you are trying to direct the traffic to a remote host. The MASQUERADE line is necessary in order to rewrite the packets going to such that packets returning from will reach your iptables box, in order to be rewritten and returned to the original sender properly.

Big picture: what are you trying to accomplish? Port forwarding is probably not the right tool.

share|improve this answer
I'm trying to pretend a local machine that I control is running a service that is actually provided by a remote machine that I don't control. (The reasons I need to do this are obscure and not worth going into.) – Fixee Sep 11 '12 at 17:14
To confirm I understand your answer: you're saying that DNAT-only may be appropriate when the router is already acting as a NAT box and you just want to add supplementary port-forwarding? I was asking if it ever made sense to use a single DNAT as the only mapping in the nat table. – Fixee Sep 12 '12 at 1:19
The site you linked ( gave an example of using DNAT to change the destination port of packets destined for the local machine, with no other NAT/MASQUERADE funny business. I would consider this a rather rare use case, since it's generally easier to simply adjust the port on which the daemon(s) is/are listening. I'm not aware of any uses of DNAT besides (1) port-forwarding on an existing MASQUERADE NAT router, (2) Phil Chen's rare use case and (3) your rare use case which involves an external host. If I haven't managed to answer your question, please do let me know. :-) – Kevin DeGraaf Sep 12 '12 at 19:06
Thanks, I don't use iptables much, so I don't have a sense of what is rare vs common usage. I find it odd (and frustrating) that the top web searches for "port forwarding with iptables" turn up sites that exclude a discussion of MASQUERADE/SNAT alongside their DNATs. – Fixee Sep 14 '12 at 4:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.