I have an existing service which is listening on, and I want to access that service from another machine, so I tried to configure port-forwarding to do it:

sudo /sbin/iptables -t nat -A PREROUTING -i eth0 -p tcp -d xx.xx.xx.xx --dport 8192 -j DNAT --to-destination

But it does not work. I even cannot see this rule when I tried to list all the rules of "nat" using:

$ sudo /sbin/iptables -t nat -L -n
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

target     prot opt source               destination

Any errors in the iptables command line above?


I think you have to get rid of the destination, I have a similar rule and this would be the adapted version to your problem:

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 8192 -j DNAT --to
iptables -A INPUT -p tcp -m state --state NEW --dport 8192 -i eth0 -j ACCEPT

Otherwise post your complete iptables listing with

(sudo) iptables -L -n -v
  • Yes, with your suggestion, the rule appears, but I still cannot connect to 8192 port from another machine – ciphor May 2 '13 at 9:54
  • i think forwarding should be enabled for this to work. – Laurentiu Roescu May 2 '13 at 10:15
  • Yes, this is mandatory: echo 1 > /proc/sys/net/ipv4/ip_forward – german_guy May 2 '13 at 11:01

There is a sysctl setting preventing dnat to loopback. replace eth0 below with your external interface traffic is coming in on.

To allow it

# sysctl -w net.ipv4.conf.eth0.route_localnet=1

and to check the setting.

# cat /proc/sys/net/ipv4/conf/eth0/route_localnet 

Now set your dnat to will work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.