Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use NAT to move requests from external ports to an internal ip address and port hosted with proxmox.

Something like this:

iptables -t nat -A PREROUTING -i vmbr0 -p tcp --dport 8000 -j DNAT --to

However even when I try to temporarily block port 8000 the requests still go through and I can access the web pages.

Can you not block ports on the host machine when using NAT? Do I have to do this on the virtual machine? Is this just the wrong command? ufw deny 8000

share|improve this question
up vote 1 down vote accepted

You're using portforwarding in the PREROUTING chain, so you have to use Port blocking in the FORWARD chain on the host system or block the port in the INPUT chains of the guest system.

But it's easier to delete the portfording rule to make the website inaccessible

Look at this chart to understand how the IPTables Chain Order works:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.