Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two questions.

Question 1: My debian machine has interface eth3 with ip 192.168.57.28. If someone tries to connect to 192.168.57.28:1234 how do I redirect the request to another machine: 192.168.57.25:80?

Question 2: If my debian machine has two interfaces: eth3 with 192.168.57.28 and ppp0 with some dynamic IP and someone tries to connect via ppp0 on port 1234, how do I redirect the request to 192.168.57.25:80?

I have tried this:

$ iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 192.168.57.25:80
$ echo 1 > /proc/sys/net/ipv4/ip_forward

but it doesn't work.

share|improve this question

1 Answer 1

up vote 2 down vote accepted
iptables -A PREROUTING -t nat -i eth3 -p tcp --dport 1234 -j DNAT --to-destination 192.168.57.25:80
iptables -A FORWARD -p tcp -d 192.168.57.25 --dport 80 -j ACCEPT
iptables -A POSTROUTING -t nat -s 192.168.57.25 -o eth3 -j MASQUERADE

The first one specifies that all incoming tcp connections to port 1234 should be sent to port 80 of the internal machine 192.168.57.25. This rule alone doesn’t complete the job because iptables denyes all incoming connections. Then we accept the incoming connection to port 1234 from eth3 which connect to the Internet with the publich IP by the second rule. We add the second rule in FORWARD chain to allow forwarding the packets to port 80 of 192.168.57.25.

EDIT: POSTROUTING added.

To keep track of the connection. otherwise the outside host would see the Internal IP 192.168.57.25 which he has no clue of.

EDIT2: Just got the hint that it should be --to-destination instead of --to (sry)

share|improve this answer
    
I have tried your suggestion, but it does not work. I can browse to 192.168.57.25 and the webpage returns, but browsing to 192.168.57.28:1234 does not work. –  Dánjal Salberg Adlersson Aug 21 '13 at 10:30
    
@DánjalSalbergAdlersson Updated my Post (missed something. sry.) –  Daywalker Aug 21 '13 at 10:51
    
I tried your suggestion, but it did not work. Then I change to last one to this: iptables -A POSTROUTING -t nat -j MASQUERADE, then it worked! –  Dánjal Salberg Adlersson Aug 21 '13 at 11:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.