Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two questions.

Question 1: My debian machine has interface eth3 with ip If someone tries to connect to how do I redirect the request to another machine:

Question 2: If my debian machine has two interfaces: eth3 with and ppp0 with some dynamic IP and someone tries to connect via ppp0 on port 1234, how do I redirect the request to

I have tried this:

$ iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination
$ echo 1 > /proc/sys/net/ipv4/ip_forward

but it doesn't work.

share|improve this question
up vote 4 down vote accepted
iptables -A PREROUTING -t nat -i eth3 -p tcp --dport 1234 -j DNAT --to-destination
iptables -A FORWARD -p tcp -d --dport 80 -j ACCEPT
iptables -A POSTROUTING -t nat -s -o eth3 -j MASQUERADE

The first one specifies that all incoming tcp connections to port 1234 should be sent to port 80 of the internal machine This rule alone doesn’t complete the job because iptables denyes all incoming connections. Then we accept the incoming connection to port 1234 from eth3 which connect to the Internet with the publich IP by the second rule. We add the second rule in FORWARD chain to allow forwarding the packets to port 80 of


To keep track of the connection. otherwise the outside host would see the Internal IP which he has no clue of.

EDIT2: Just got the hint that it should be --to-destination instead of --to (sry)

share|improve this answer
I have tried your suggestion, but it does not work. I can browse to and the webpage returns, but browsing to does not work. – Dánjal Salberg Adlersson Aug 21 '13 at 10:30
@DánjalSalbergAdlersson Updated my Post (missed something. sry.) – Daywalker Aug 21 '13 at 10:51
I tried your suggestion, but it did not work. Then I change to last one to this: iptables -A POSTROUTING -t nat -j MASQUERADE, then it worked! – Dánjal Salberg Adlersson Aug 21 '13 at 11:57

Thanks to Daywalker and Dánjal Salberg Adlersson. After hours of swearing, port forwarding with iptables finally works. (tested on Debian)






echo "1" > /proc/sys/net/ipv4/ip_forward
$IPTBL -A PREROUTING -t nat -i $IF_IN -p tcp --dport $PORT_IN -j DNAT --to-destination ${IP_OUT}:${PORT_OUT}
$IPTBL -A FORWARD -p tcp -d $IP_OUT --dport $PORT_OUT -j ACCEPT
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.