Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to build a router from ubuntu 12.04. What I am trying to do is, by using 1 public IP ( and I tons of local ips like, to map each port to one ip like; <-> // should bring me web server on <-> <->

What I did is; I build the NAT rules like below (Assuming that this accepts packets from eth0 and forward it through eth1)

iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain
iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface eth0 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
service ufw restart

And then tried these commands;

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j DNAT --to
iptables -A INPUT -p tcp -m state --state NEW --dport 80 -i eth0 -j ACCEPT

I Tested is by trying to open the web site with the IP (Which is the Ubuntu Server IP)

Additionally; Output of "iptables -t nat -L" is;

target     prot opt source               destination
DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

What I tried is to iptables with various nat rules but I cannot achieve this. How can I achieve this ?

Thanks in advance, Baris

share|improve this question
What doesn't work? What exactly did you use for rules. What errors do you get? Add more details. – Zoredache Jan 7 '14 at 17:42
Zoredache, you are right, sorry for misinformation. I am now adding the new info. – Harun Baris Bulut Jan 7 '14 at 18:15
up vote 0 down vote accepted

Assuming you have the NAT itself set up and working (there are about a million tutorials for that), port forwarding is just a normal rule, eg

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 5678 -j DNAT --to
iptables -A INPUT -p tcp -m state --state NEW --dport 5678 -i eth0 -j ACCEPT

Lather, rinse, and repeat for every port you want to forward somewhere.

To set up the NAT itself, do something like this:

ifconfig eth1
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

(Assuming eth1 is your local network and eth0 is your internet connection.) Then add the port forwarding commands.

share|improve this answer
Hi Bandrami, I did what you told me but it still does not work, maybe I am missing something so I added how I build the NAT itself. Thanks – Harun Baris Bulut Jan 7 '14 at 18:19
Hi again Bandrami, I am trying to analyze the situation by looking at "iptraf" and with the previous configuration I was able to see ip but with your config I cannot see it either. – Harun Baris Bulut Jan 7 '14 at 18:29
Thanks Bandrami, what you did was correct, however we applied it wrong :) – Harun Baris Bulut Jan 18 '14 at 8:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.