Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For load balancing purposes, occasionally our servers forward requests to a different port; The default port for our service is port 5000.

This is the code used: iptables -t nat -A PREROUTING -p tcp --dport 5000 -j REDIRECT --to-port 5001

After applying this code, the port forwarding works great for new requests.
New requests on port 5000 are forwarded to our service on port 5001. However, existing connections remain connected to port 5000, as displayed by netstat.

My question is, how do I force this iptables rule to immediately apply to all connections, both new and existing (established) - without dropping all connections first?

Thanks in advance

share|improve this question
You can't do that. What are you actually trying to accomplish? – Michael Hampton Feb 6 '14 at 22:44
That doesn't make any sense. How could the local endpoint of the connection possibly handle such a change? – David Schwartz Feb 7 '14 at 4:17
up vote 3 down vote accepted

The existing connections stay connected because iptables NAT tracks the state of connections-- that is, it's "stateful".

The iptables tools won't let you modify the state of existing connections. Even if you could somehow modify the existing connections in the iptables NAT connection tracking table, how would you alert the remote clients to change the port they're communicating with? That's the rub-- there's no functionality in the TCP protocol to tell a remote client "change to port number ###". That's just not part of the protocol (and since it isn't there's no reason for iptables to let you do what you're asking for).

share|improve this answer
Okay thanks for clearing that up, I was hoping I wouldn't have to write a relay proxy, and use IPtables instead, but alas. – Joni Chicago Feb 6 '14 at 23:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.