Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On "Server A", I have a service running on port 1445. "Server B" can connect to "Server A" on port 445 via the following rule:

iptables -t nat -A PREROUTING -d -p tcp -m tcp --dport 445 -j REDIRECT --to-ports 1445

This does not work for connections initiated on "Server A", i.e. local connections. What can I do?

share|improve this question
up vote 6 down vote accepted

iptables -t nat -A OUTPUT -d -p tcp -m tcp --dport 445 -j REDIRECT --to-ports 1445

Because locally originated packets go through OUTPUT, rather than through PREROUTING.

share|improve this answer

You should better read some manuals and docs.

Anyway brief chains description:

* “PREROUTING”: Packets will enter this chain before a routing decision is made.
* “INPUT”: Packet is going to be locally delivered. (N.B.: It does not have anything to do with processes having a socket open. Local delivery is controlled by the “local-delivery” routing table: `ip route show table local`.)
* “FORWARD”: All packets that have been routed and were not for local delivery will traverse this chain.
* “OUTPUT”: Packets sent from the machine itself will be visiting this chain.
* “POSTROUTING”: Routing decision has been made. Packets enter this chain just before handing them off to the hardware.

And take a look here:

Netfilter packet flow


share|improve this answer

if you use lxc or other virtualization technology, you redirect all traffic from port 445 to container's 1455.

The local request in Server A will not pass PREROUTING. The reason was addressed before. Local traffic will not access nat table, but if you use DNAT before, it only works for outer traffic to Server A, REDIRECT only worked for port forward, it can not be used as DNAT

share|improve this answer
Most of this is either factually incorrect or inaccurate. Please consider reworking this answer. – Felix Frank Jun 13 '14 at 16:25
Thanks for your editing work!@FelixFrank – dawncold Jun 14 '14 at 0:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.