Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We run ubuntu on our gateway machine. We have a DNAT iptables rule sending traffic on 80 and 3306 to an internal ip address that runs a webserver. It doesn't work at all.

eth1 is the wan interface, eth0 is the local one

-A INPUT -p tcp -m tcp -m multiport -s -j ACCEPT --dports 25,80,443,465,3306
-A OUTPUT -d -o eth1 -j ACCEPT
-A PREROUTING -p tcp -d $EXT_IP -i eth1 --dport 80 -j DNAT --to-destination
-A PREROUTING -p tcp -d  $EXT_IP -i eth1 --dport 3306 -j DNAT --to-destination
-A FORWARD -p tcp -d --dport 80 -j ACCEPT
share|improve this question
That "firewall" is a complete mess. I would probably blow it away and start over. – Michael Hampton Nov 22 '13 at 19:46
Just to expand on @MichaelHampton - you are filtering in your NAT table (instead of the FILTER table), there are chains doing nothing, and no commenting (hint: -m comment). As to your original question, the counters on the rules in the PREROUTING chain are 0 - this suggests that the traffic you are expecting to DNAT hasn't even hit the box (or you haven't tested it since you last reset the counters) – fukawi2 Nov 22 '13 at 20:42
up vote 1 down vote accepted

You need the corresponding rules in the filter table to allow the traffic through the filter. The rules you've posted only handle the NAT part.

-A FORWARD -p tcp -d -i eth1 --dport 80 -j ACCEPT
-A FORWARD -p tcp -d -i eth1 --dport 3306 -j ACCEPT

EDIT: OP didn't include full output in first post.

share|improve this answer
I edited my answer to include all of the lines from the iptables relevant to our web server – Chris G. Nov 22 '13 at 13:26
That suggests you have yet more lines, and they can interfere with each other. Could you post instead the entire outputs of iptables -L -n -v and iptables -t nat -L -n -v? Also, the INPUT line currently shown in the question looks to me like it should have -d, not -s – MadHatter Nov 22 '13 at 13:30
Updated the question – Chris G. Nov 22 '13 at 13:39

try this:

echo "1" > /proc/sys/net/ipv4/ip_forward

share|improve this answer

You need POSTROUTING rules as well, for instance

-A POSTROUTING -p tcp -o eth1 -m multiport --sports 80,3306 -s -j SNAT --to-source $EXT_IP           
share|improve this answer
Added that but to no avail. Testing http externally still gets me connection refused. – Chris G. Nov 22 '13 at 14:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.