Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I cannot get requests to my server on port 80 to redirect to my client on port 8080


I am using a CentOS 6.3 VM as the server, the client is an Arduino

Server eth0 - eth1 -

Client eth0 - 10.14.45

End Goal

Any sort of fix that will allow me to get the webpage from my internal client

What I have Tried

I have tried to modify my iptables in various ways to allow me access. Closest I got was my client registered that a connection was made but the webpage would not load. This also occurred when I used an SSH tunnel. So I think there is some setting that I am over looking that is not allowing it to forward correctly

# cat /proc/sys/net/ipv4/ip_forward


-A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to
-A POSTROUTING -s -o eth0 -j SNAT --to-source
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -s -o eth0 ! -d -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Thanks in advance for any and all help!

share|improve this question
up vote 0 down vote accepted

Here's what works for me on my VM server (adapted to your IPs):

## Allow through firewll
iptables -I FORWARD -d -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
## Set up NAT forwarding rule
iptables -t nat -I PREROUTING -p tcp -i eth0 --destination-port 8080 -j DNAT --to-destination

It looks like you are missing the first rule, which allows the packets to come through the firewall. The nat rule on yours looks ok though.

Note, that "-I" inserts at the top of the rule chain, "-A" appends to the bottom. In the case of the first rule, we want it to come before the "reject" rule in your filter table -- the easiest way is to go ahead and insert it at the top (if you are modifying an existing table -- otherwise, go ahead and convert it to "-A" and put it before the "reject" rule if modifying an existing config file).

share|improve this answer
Makes sense, just wondering about this This rule is to allow my clients packets through on port 80? Then I would want it to be for my network Thanks for your help, I really appreciate it! – arduinosystem Apr 30 '13 at 2:24
I'm assuming your internal host is (the messages has "10.4.45"). So yes, this is in the Filter table (the default table if no "-t ..." flag is specified), and specifically in the FORWARD chain (section) of the filter table. The FORWARD chain examines any inbound packet that is getting forwarded to somewhere else. So the says to look at only packets bound for ip address, and where the destination port is 80, and allow them through. So as long as this appears before the final "FORWARD...REJECT" line they will go through. – Derek Pressnall Apr 30 '13 at 2:41
Ran out of room in the previous comment -- but to answer your question, yes you can also specify "" and leave off the --dport (or specify a range), and what would allow packets in to any host you set up a forward rule to. I normally don't do that, so I don't have any verified examples handy and wanted to make sure I posted a working example. But if you still have trouble I'll work out an example in my lab tomorrow and update the post. – Derek Pressnall Apr 30 '13 at 2:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.