Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's my scenario:


There are 3 machines:

A: on the internet : has ip (a.a.a.a), has port pa open

B: my server / gateway : has ip (b.b.b.b), has port pb open

C: on the internet : has ip (c.c.c.c), has port pc open


The owner of machine A offers a service via port pa that must be accessed on machine C via port pc. The problem is, the owner of A can only allow to directly connect with my server, machine B on port pb.

Note that, A and C are on the internet, so in effect, I have to act as a gateway between two machines on the internet (the literature I've found in most firewall docs concerns acting as a gateway between the internet and your local network).


Machine B is running OpenSuse 11.4


My task is to make sure I give machine C the service offered by A via my server B, in such a way that traffic from A:pa ends up on C:pc and traffic from C:pc ends up on A:pa.

So, how can I achieve this, say using iptables or another Linux / Unix utility? Is it even possible?

Hypothetical Solution:

Here's an Idea I have in mind, but am not sure it's legit or makes sense:

iptables -t nat -A PREROUTING -p tcp --source a.a.a.a --source-port pa \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination c.c.c.c:pc


iptables -t nat -A PREROUTING -p tcp --source c.c.c.c --source-port pc \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination a.a.a.a:pa
share|improve this question

I'm assuming that C is connecting to A:pa (it's not quite clear). You need to perform both DNAT and SNAT on B for these connections from C:

iptables -t nat -A PREROUTING -p tcp -s c.c.c.c -d b.b.b.b --dport pb -j DNAT --to-destination a.a.a.a:pa
iptables -t nat -A POSTROUTING -p tcp -d a.a.a.a --dport pa -j MASQUERADE
share|improve this answer
Thanks, to make it clearer, surely C wants to connect to A:pa, but can't do it directly, that's why C must connect to B:pb and B:pb acts as a proxy for A:pa. The same applies to A:pa wanting to talk to C:pc. – nemesisfixx Mar 15 '13 at 5:54
@nemesisfixx Do you mean that A also needs to connect to C:pc (as in make a TCP connection), or just that packets need to get back from A to C for the C->A connection? – mgorven Mar 15 '13 at 16:29
packets from A need to get to C, and packets from C need to get to A. Only that a direct connection is not possible, thus B must provide the gateway. – nemesisfixx Mar 15 '13 at 17:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.