Quick examples for forwarding traffic coming from outside and interfaces within the same machine from address original to another address for ip versions 4 and 6 (possibly excluding ipsec traffic with an endpoint on the original address and existing connections at point of execution). This also does NOT redirect traffic generated by locally executing programs, for that you need the OUTPUT chain.
#Note: These forward settings are not reboot persistent
sysctl -w net.ipv6.conf.all.forwarding=1
sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -d original.add.re.ss -j DNAT --to-destination ipv4.add.re.ss
iptables -t nat -A POSTROUTING -j MASQUERADE
ip6tables -t nat -A PREROUTING -d [original.add.re.ss] -j DNAT --to-destination [2001::]
ip6tables -t nat -A POSTROUTING -j MASQUERADE
If you want to limit the forwarding to only packets from outside you have to modify the rules, either add a
-i interface naming the interface where they come in or match everything that did not originate from a local address
-m addrtype ! --src-type LOCAL. You could further exclude broadcast and multicast traffic by using
-m addrtype --dst-type UNICAST --src-type UNICAST. You should also check that the default policy for the FORWARD chain is ACCEPT or add specific rules in that chain.
Dumping the existing
nat tables can be done with
iptables -S -t filter and
iptables -S -t nat. The
filter table is where you configure the FORWARD rules if there is a DROP policy.The
-A before PREROUTING/POSTROUTING means Append. If you need to insert the rule, because there is a DROP at the end, you have to use
-I and put a number behind the chain name.