Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a weird network topology, and I'm trying unsuccessfully to forward ports.

The thing is, I have a public server, and all ports have to be forwarded from the router to the same server (sort of DMZ).

My topology:

 |       |      |
pc1   server   etc

The server runs linux (ubuntu) with iptables. The firewall is configured pretty much like this:

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT

# for every port I accept on the server (this part works perfectly)
iptables -A INPUT -p tcp --dport xxxx -j ACCEPT

# for every port I want to forward to pc1 (this is the part that doesn't work)
iptables -A FORWARD -p tcp --dport xxxx -j ACCEPT
iptables -t nat -P PREROUTING -p tcp --dport xxxx -j DNAT --to $PC1_IP
# I've also tried with the following line:
iptables -t nat -P POSTROUTING -p tcp --sport xxxx -j SNAT --to $PC1_IP

but forwarding just doesn't seem to work.

When I enable forwarding, connections can connect (or seem to be able to) but no data is trasferred. Perhaps they just time out.
When I don't enable said forwarding, connections are refused immediately.

The target pc has been checked and it can accept connections.

I've also tried sniffing a bit with Wireshark on both machines. On the server the packet is accepted, but no outgoing packet is found (I assume there should be one if DNAT rerouting actually happened). On pc1, no packet is received.

Can anyone suggest a fix? I've been googling for days, and I've tried several settings for this port - none of them worked.

share|improve this question
This question was originally posted in but I moved it here. – configurator Nov 17 '09 at 7:12
up vote 3 down vote accepted

try adding

echo 1 > /proc/sys/net/ipv4/ip_forward

to enable routing on the linux


iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

otherwise responses from local pcs will not be forwarded back to the internet.

also you might want to use:

iptables -t nat -P PREROUTING -p tcp --dport xxxx -d your.public.ip.addr -j DNAT --to $PC1_IP

if you keep your rule - any traffic sent on port xxxx from local network will be forwarded to $PC1_IP

share|improve this answer
What's the difference between using -m state --state and -m conntrack --ctstate? – configurator Nov 17 '09 at 18:13
@configurator - i've never used ctstate before, from man pages of iptables it seems they are pretty much the same, but ctstate has more matches so seems to be better suited. anyway your sample does not mention neither ctstate or state while you have drop on iptables - so you will need one or another. – pQd Nov 17 '09 at 19:59
Now when I try opening the site from inside the network (by going to the server's ip) it works, but when I try opening it from outside it doesn't work - I'm thinking the router's dmz setting is broken again. Could it be anything else? – configurator Nov 18 '09 at 17:40
@configurator - i've got no idea what kind of 'router dmz settings you have'. do you refer to the linux box or to some other router? – pQd Nov 18 '09 at 18:49
I mean the other router - the one that connects to the internet. My question was could it be something in the linux machine. Note that it only has one ethernet interface (eth0) and I haven't limited any rule by ip. – configurator Nov 18 '09 at 22:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.