Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is the scenario

I have configured a web-server in MUX. Now I want to access that web-server from Internet. Ubuntu box has two interfaces, One is connected to WAN (Public IP) and another one is connected to MUX (Private IP). MUX has no option to insert default gateway.

iptables -t nat -A PREROUTING -p tcp -i eth0 -d 103.x.x.x --dport 8001 -j DNAT --to-destination
iptables -A FORWARD -p tcp -d --dport 8080 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

It does not work.

share|improve this question
up vote 1 down vote accepted

What you want is this:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8081 -m conntrack -ctstate NEW -j DNAT --to
iptables -t nat -A PREROUTING -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -j MASQUERADE

hope this helps.

share|improve this answer
This looks pretty complicated. I want to learn some of it. Do you know some nice documentation I can refer to? – SamK Oct 18 '12 at 12:44
Use an irc client and connect to #iptables – val0x00ff Oct 18 '12 at 14:53
thanks.....It works..... – user141610 Oct 20 '12 at 5:00
@val0x00ff Is it any problem If I use -m state --state instead of m conntrack --ctstate? – user141610 Oct 20 '12 at 10:59
@user141610 The difference between the two is explained here:… – val0x00ff Oct 21 '12 at 18:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.