Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an existing service which is listening on, and I want to access that service from another machine, so I tried to configure port-forwarding to do it:

sudo /sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -d xx.xx.xx.xx --dport 8192 -j DNAT --to-destination

But it does not work. I even cannot see this rule when I tried to list all the rules of "nat" using:

sudo /sbin/iptables -t nat -L -n


target prot opt source destination


target prot opt source destination

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

Any errors in the iptables command line above?

share|improve this question

2 Answers 2

I think you have to get rid of the destination, I have a similar rule and this would be the adapted version to your problem:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 8192 -j DNAT --to
iptables -A INPUT -p tcp -m state --state NEW --dport 8192 -i eth0 -j ACCEPT

Otherwise post your complete iptables listing with

(sudo) iptables -L -n -v
share|improve this answer
Yes, with your suggestion, the rule appears, but I still cannot connect to 8192 port from another machine – ciphor May 2 '13 at 9:54
i think forwarding should be enabled for this to work. – Laurentiu Roescu May 2 '13 at 10:15
Yes, this is mandatory: echo 1 > /proc/sys/net/ipv4/ip_forward – german_guy May 2 '13 at 11:01

There is a sysctl setting preventing dnat to loopback. replace eth0 below with your external interface traffic is coming in on.

To allow it

sysctl -w net.ipv4.conf.eth0.route_localnet=1

and to check the setting.

cat /proc/sys/net/ipv4/conf/eth0/route_localnet

Now your dnat to will work.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.