Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Try as I might, I can't get this to work now for 2 days. Your move, internet.

I want iptables to transparently forward (localhost) to and I don't want to have access to any of

I have a wideband business class cable connection feeding into my office, which can take traffic on just about any port. It is quite limited in its feature sets so for years I've double NAT'ed to a nicer netgear wifi router (bridging it to the upstream modem isn't possible). From the first cable modem I forward all ports to the netgear router and from there I forward to everything else (media server, mail server, vpn server, etc)

Today I put a VM on a new vmware NAT network though. I want it completely isolated from the main network, and I want to transparently forward from its host on the main network to its vmware NAT'ed network. Topology:    
+-----+   +-------+   +--------------+   +----------------------+
| WAN |<->| Modem |<->| Netgear wifi |<->| Debian Linux 7       |
+-----+   +-------+   | Router       |   | Server Running       |
                      +--------------+   | VMWARE Workstation   |
                                                 \_| Guest        |
                                                   | Linux VM     |
                                                   | |
    -Public IP-
      -Router-           <=========== Flow of traffic
-Host Server/iptables-
  -Virtual Machine-

When I type nc localhost 2222 on the main host, I want the guest to respond with an ssh prompt. That what I need, so that it behaves like this:

+-----+   +-------------------+   +--------------------+
| WAN |<->| PUB IP, Port 2222 |<->| VM |
+-----+   +-------------------+   +--------------------+

I've tried to accomplish this using the firewall rules below on the VMware host, and many, many other similar forms of iptables rules. No matter what I try, it does NOT work:

:INPUT ACCEPT [18:3693]
:OUTPUT ACCEPT [330:21304]
-A PREROUTING -p tcp -m tcp --dport 2222 -j DNAT --to-destination
# Completed on Tue Dec 17 12:33:29 2013
# Generated by iptables-save v1.4.14 on Tue Dec 17 12:33:29 2013
:INPUT ACCEPT [3188:201562]
:OUTPUT ACCEPT [4390:6225036]
-A FORWARD -d -o vmnet99 -p tcp -m tcp --dport 22 -j ACCEPT
# Completed on Tue Dec 17 12:33:29 2013

What do I need to do to get to forward transparently back and forth for ??

UPDATE: You can download the wireshark capture file here: (While the capture was running I ran this command: $ ping -c1 ; sleep 1 ; nc localhost 2222)

share|improve this question

closed as off-topic by Wesley, mdpc, MadHatter, cole, Ward Dec 18 '13 at 4:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Wesley, mdpc, cole, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

When I type nc localhost 2222 - When you type that with your current rules what happens? Do you get an error, or what? Can you fire up tcpdump on the VM host, or the VM guest and see if the packets are being modified? – Zoredache Dec 17 '13 at 19:33
Not sure to understand : you want to be redirected to when you type publicip:2222 ? – krisFR Dec 17 '13 at 20:01
@linuxrawkstar : still not understand. According to your scheme port 2222 is for public ip, so what localhost:2222 means for you in this case ? – krisFR Dec 17 '13 at 20:12
Why do you want things to be so complicated by using so many hops ? i would use port-forwarding at Router side : publicip:2222 --> and use iptables to isolate (filter) your internals LANs – krisFR Dec 17 '13 at 20:23
You do know that port-forwarding on a host can't be tested from that host, don't you? – MadHatter Dec 17 '13 at 20:47

As @MadHatter pointed out in the comments, the iptables forwarding and NAT'ting can't be tested from the inside. You have to follow the path that the packets would follow from an external point of origin.

In other words, your testing will fail if you attempt to activate the port redirection right from the server whose IP tables implement the forwarding. You can't do it on the localhost! SSH to a server outside your network and try to re-enter the network on the port that you're forwarding.

If your iptables rules are correct like the ones you see here, you will find that the port forwarding works perfectly.

TIP: If you are running on a Debian-based Linux distro, install the iptables-persistent package to keep your iptables tweaks persistent between reboots.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.