I'm running cPanel/WHM with ConfigServer Firewall (csf).

I want to forward port 8080 on my webserver to an internal server with an IP of lets say thats running a webserver on port 80. How can I do this?

My WAN ip is running on eth0 The internal server is connected using the eth1 interface.

What would be the appropriate IPtables cmd to do this?


Something like this should work

sudo /sbin/iptables -t nat -I PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination

If you haven't already done so you may need to enable IP forwarding too

/sbin/sysctl -w net.ipv4.ip_forward=1

and to make it permanent edit /etc/sysctl.conf and set

net.ipv4.ip_forward = 1


As the policy on your FORWARD chain is DROP you will need to allow packets through. I don't think your current FORWARD rule is doing anything helpful so delete it.

Enable packets sent to FORWARD from eth0:8080 to be sent to

/sbin/iptables -I FORWARD  -p tcp -m tcp  -d --destination-port 80 -j ACCEPT

Allow packets to go the other way too

/sbin/iptables -I FORWARD -i eth1 -p tcp -m tcp -j ACCEPT

You mat want to restrict the latter further.

  • Will that actually working considering the ip is on eth1? – William Balkcom Jul 11 '11 at 22:37
  • Didn't seem to work. – William Balkcom Jul 12 '11 at 0:00
  • @WilliamBalkcom: yes, you are routing packets from eth0:8080 -> or at leasts that's what you requests. This works on a test system I have. Check that you have something listening on Is running a firewall and is it allowing connections on port 80 ? Check that your FORWARD chain is allowing packets. – user9517 Jul 12 '11 at 6:55
  • I have a webserver listening on, it is allowing all connections. The connection to is established through eth1 and eth1 is configured like this: gyazo.com/42a58b08b6d2dcbd1bee2b5148a478e6.png And actually the IP is, just using as an example. – William Balkcom Jul 12 '11 at 7:11
  • @WilliamBalkcom: please post the (suitably redacted) output of iptables -l -v -n and iptables -t nat -L -v -n – user9517 Jul 12 '11 at 8:29

Something like:

iptables -A PREROUTING -t nat -i eth1 -p tcp \ 
  --dport 8888 -j DNAT --to

Sends forwards the requests on port 8888.

iptables -A INPUT -p tcp -m state --state NEW --dport 8888 -i eth1 -j ACCEPT

Allows incoming connections ton port 8888.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.