I would like to port forward all that enter to to

how can I do this with iptables in

I tried this, but didnt work:

iptables -A PREROUTING -t nat -i ens33 -p tcp --dport -j DNAT --to

iptables -A FORWARD -p tcp -d --dport 80 -j ACCEPT

1 Answer 1


The problem in your setup is that packet's source addresses remain the same. An example of the packet flow, where client is

  1. Client's packet with source arrives to port 80. Packet's source address is and destination
  2. IPTables does destination NAT, changing destination to Packet's source address is and destination
  3. Packet is forwarded to It sends a response packet to Response packet's source address is and destination address
  4. Response packet reaches the client. However, since the original packet was sent to, the source address does not match client's expectations, therefore the packet is dropped.

The solution is to add MASQUERADE rule, which changes source IP address to on port forwarded packets:

iptables -t nat -A POSTROUTING -d -p tcp --dport 80 -j MASQUERADE

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .