Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I got referred here from StackOverflow.

I'm using IpTables to forward an incoming port on one server to an external server (not on LAN) and the same port. The problem I'm having is that I have to use MASQUERADE or it will not forward. So all users on my server have my first servers IP as their IP.

Here is a breakdown of my iptables configuration.

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:http
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

iptables -t nat -L
target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere             tcp dpt:25565 to:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Any help would be deeply appreciated so I can port forward from the one server to the other.

Also, a question, when I do this, does it just trannsfer the connection, then all data back and forth is between the two PCs? Or am I doubling up my bandwidth?

share|improve this question
There doesn't seem to be any point to this. You are only consuming double your bandwidth for no apparent benefit whatsoever. – Michael Hampton Dec 10 '13 at 2:32
I don't want the public IP of my gameserver to really be known or anything. I suppose it would be wiser to use a subdomain instead... – OBLE Codemonkey Dec 10 '13 at 2:53
So is this supposed to be some kind of crude DDoS protection? – Michael Hampton Dec 10 '13 at 2:55
So you're a game server hosting company? What are you using for a top-rack firewall? – Wesley Dec 10 '13 at 3:21
What's your main question here? You're using MASQUERADE and it's working as expected. – etagenklo Dec 10 '13 at 9:51

masquerade is working as expected and is needed. If the external server would receive the original local ip addresses as source addresses, it wouldn't know where to send back the answer, or at best it would try to send it through its local network. A machine routing with masquerading handles all the connections, redirecting then the answers to the correct local machine.

share|improve this answer
If you want to understand further, Google for Asynchronous or Asymmetric Routing. What you are looking to do isn't technically possible (at least not at layer 2/3 where iptables works), and isn't a good plan anyway. – fukawi2 Dec 11 '13 at 2:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.