Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently trying to forward port 80 to port 4999 so that 80 is exposed but 4999 is not. After looking into this, I found that the tabels below do what I want successfully, but I do not understand how they work. Could anyone describe to me what is going on here and tell me if this causes any security problems?

:INPUT ACCEPT [404:24676]
:OUTPUT ACCEPT [360:25177]
-A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 4999
-A PREROUTING -p tcp -m tcp --dport 4999 -j REDIRECT --to-ports 80
:OUTPUT ACCEPT [8142:1141863]
-A INPUT -p tcp -m tcp --dport 4999 -j ACCEPT
share|improve this question
I know it doesn't answer the question, but I don't see why you think you would have improved your security at all by having a service listen on an alternate port, and the NAT it so that traffic destined for the standard port is redirected. No particular port is any more or less secure then any other. The security is all about the application that is listening to that port. – Zoredache Feb 6 '13 at 23:16
In terms of security, I was just curious if this would make me more vulnerable since I did not understand it what it was doing. The forwarding is a requirement. – quinton Feb 7 '13 at 18:05

The first prerouting rule change incoming port 80 trafic to port 4999 and the firs input rule accept it.

The second prerouting rule change the port 4999 traffic to port 80 and the second input rule drop it.

I think change the second prerouting rule to -j DROP will do the job better.

Or change de default INPUT policy to DROP, and delete the second INPUT rule.

Like Zoredache told, it has no much sense.

share|improve this answer
So are you saying that when forwarding a port locally it does not go through the nat table again? For example, would the behavior be different if i were forwarding to another machine? – quinton Feb 7 '13 at 18:09
Let see another example: when a packet comes, iptables apply the prerouting chain (nat table), if it match your rules the destination port is changed. Then go to input chain (filter table), if it match your first rule is accepted, if not is dropped. There is not forwarding table here. – Brigo Feb 8 '13 at 14:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.