i found several tutorials on how to do it, but got none of them to work :/

My setup:

FIREWALL - reachable from the internet - eth0: xxx.xxx.xxx.xxx (public ip) - eth1:

SERVER - reachable from FIREWALL - eth0:

Because I still want to be able to connect to the firewall on port 22, I would like to forward incoming connections on port 2222 to

ping and ssh from FIREWALL to SERVER works. ping and ssh from SERVER to FIREWALL works as well (although login is only allowed with public key and the SERVER is not allowed...)

ping and ssh from anywhere to FIREWALL works.

IP forwarding is enabled:

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

Posting my iptables-rules does not make much sense because none of the rules worked (used PREROUTING, POSTROUTING, FORWARD...) and there are no other rules.

Yes, my firewall does not block anything. But this is not about security (yet).

I tried everything I found on the first to pages of: https://www.google.de/search?q=iptables+forward+ssh

Any suggestions?

Regards, Jens

UPDATE Here's the output of tcpdump -n -i any after using Khaled's iptables command:

15:42:33.852718 IP home-ip.56008 > firewall-public-ip.2222: Flags [S], seq 1141341765, win 14600, options [mss 1460,sackOK,TS val 871214 ecr 0,nop,wscale 7], length 0
15:42:33.852752 IP home-ip.56008 > Flags [S], seq 1141341765, win 14600, options [mss 1460,sackOK,TS val 871214 ecr 0,nop,wscale 7], length 0

I would have guessed that in the second line there would be something like ... IP > ...

These two lines repeat a few times as my ssh-client tries multiple times to connect. But there is not any answer.

2nd Update The routes of the server ( are here. I just added a route

public-firewall-ip       1

but this has no effect. On the server runs Win XP with cygwin's sshd installed. I did not mention this before because ssh from the firewall to the server works just fine. But when it comes to routing I feel Windows is somewhat limited.

Now I'm installing Wireshark on the server and will paste the result in a few miniutes.

Trace on server The trace on the server shows an arriving SYN on port 22 and a leaving SYN,ACK to my home-ip. I think there is the error. The ACK should be sent to the firewall than be masqueraded because in the leaving package the source IP/Port now is No way this reaches my laptop at home behind a NAT... or is there a way?

  • btw: workaround with ssh port forwarding works... ssh -L 4022: FIREWALL and then ssh localhost -p 4022 # connects to SERVER
    – Jens
    Aug 26, 2012 at 11:28
  • The trace shown in your update indicates that there is no problem in your firewall machine config. It is forwarding the request to the server (2nd packet). The problem should be in the server machine. It may be a routing issue. Can you post the routing table of the server machine
    – Khaled
    Aug 27, 2012 at 6:25
  • The ACK should be sent to the home-ip but via the firewall machine. In other words, destination IP should be home-ip and destination MAC should be firewall-mac.
    – Khaled
    Aug 27, 2012 at 10:38
  • Any way I can tell Windows to do just that?
    – Jens
    Aug 27, 2012 at 10:45
  • All you need to do is to make sure that the firewall IP is the default gateway of this Windows machine. That's it.
    – Khaled
    Aug 27, 2012 at 10:55

1 Answer 1


If you are allowing the traffic to pass through your firewall and have IP forwarding enabled, you just need one NAT rule to forward SSH traffic on port 2222. A one like this should do the work:

$ iptables -t nat -A PREROUTING -d x.x.x.x -p tcp --dport 2222 -j DNAT --to-destination


Network sniffer is your friend when debugging such problems. You can run tcpdump on the firewall machine and see if you can catch the request coming and the same request should leave the firewall machine.

  • Is there any way to debug? If I try to connect, I get ssh: connect to host FIREWALL port 2222: Connection timed out. output of iptables-save
    – Jens
    Aug 26, 2012 at 12:16
  • @Jens: You can use network sniffer as indicated in the updated answer. Post your results to help you analyzing it.
    – Khaled
    Aug 26, 2012 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.