Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am on Ubuntu 12.04.2 LTS

cat /proc/sys/net/ipv4/ip_forward

I reset iptables with the following commands:

iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT

I want to redirect traffic destined for port 80 to 1337. These commands accomplish that:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 1337
iptables -t nat -A OUTPUT -o lo -p tcp --dport 80 -j REDIRECT --to-ports 1337

I continue with the following commands in order to block all incoming traffic except SSH and I expect the port redirection still works:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport ssh -j ACCEPT
iptables -A INPUT -j DROP

But the port redirection no longer works.

Adding iptables -A INPUT -p tcp --dport 80 -j ACCEPT before iptables -A input -j DROP doesn't make it work either.

What else do I need to add or change?

share|improve this question
Ah. It turns out that if I add iptables -A INPUT -p tcp --dport 1337 -j ACCEPT before iptables -A input -j DROP, the port redirection works. But I don't want to allow direct traffic to port 1337. – John Indra Jun 23 '13 at 10:05

To prevent direct traffic on 1337 you could do:

iptables -A INPUT -p tcp -s --dport 1337 -j ACCEPT so only traffic from the host itself (which is the redirect) will be accepted.

share|improve this answer
Just tried what you suggested with iptables -R INPUT on the rule. I couldn't even connect to port 80. – John Indra Jun 25 '13 at 7:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.