Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The setup I have is this:

[client01] <-A-> [server01] <-B-> [server02]

client01 can access port 9300 on server01 (connection A). server01 can only access port 9300 on server02 (connection B) via ssh. What's the best way to make all traffic on port 9300 to server01 go to port 9300 on server02?

I can successfully do this with an ssh tunnel from client01 to server01 to server02, but I don't want to have to run ssh on client01. When I ssh from server01 to server02 forwarding port 9300 (ssh -g -L9300:localhost:9300 server02 on server01), it doesn't work -- am I using the wrong command?

EDIT: added that server02 is only reachable via ssh

share|improve this question
up vote 3 down vote accepted

You can do this w/ an iptables DNAT rule-- something like:

iptables -A PREROUTING -p tcp -d x.x.x.x --dport 9300 -j DNAT --to-destination y.y.y.y:9300

Substitute in the IP address of server01 for x.x.x.x and the address of server02 for y.y.y.y and you're set.

This all assumes, of course, that you're running iptables on server01. This also assumes that server02 is using server01 to route traffic back to the Internet. If server02 isn't then this isn't doing to do what you want.

Edit in light of the SSH-only connectivity between the machines:

Your command-line for the SSH port forward looks okay, except that you need a space between the "L" and "9300". You'll also need to be sure that the server01 computer will accept inbound connections on port 9300. Have a look at your iptables INPUT chain in the filter table (iptables -L INPUT) to be sure that the traffic will be allowed in.

You'll need to have that tunnel kept up persistently, too.

share|improve this answer
Oops, just realized that server02 is only accessible via ssh - I tried creating a tunnel and then setting the --to-destination to (the tunnel port), but that didn't work – Ankit Oct 18 '12 at 5:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.