I'm facing the problem, that my iptables rules aren't working anymore after I changed OS from Ubuntu 8.04 to Debian Squeeze.

I'm trying to do a Port Forwarding by

iptables -t nat -A PREROUTING -d $extip -i eth0 -p tcp -m tcp --dport 5777 -j DNAT --to-destination

/proc/sys/net/ipv4/ip_forwarding is set

All policies are set to ACCEPT is in FORWARD chain

tcpdump output:

IP some_ip.33517 > ext_ip.5777: Flags [S], seq 3521672809, win 14600, options [mss 1450,sackOK,TS val 1691129923 ecr 0,nop,wscale 7], length 0
IP ext_ip.5777 > some_ip.33517: Flags [R.], seq 0, ack 3521672810, win 0, length 0

As you can see, there is a RST sent after SYN. I have no clue why this is happening.

I hope someone can help me. Thanks in advance.

  • What does your nat table currently look like? And, is the service you intend to connect to actually running? – Michael Hampton Sep 25 '13 at 21:26
  • Just the PREOTUING line and iptables -A POSTROUTING -s -o eth0 -j SNAT --to-source ext_ip Yes, the service is running. I can connect from the firewall box – Conrad Sep 25 '13 at 21:57
  • Which interface did you do your tcpdump on? In the case of NAT you might need to do something like tcpdump -qni any port 5777. – Zoredache Sep 25 '13 at 23:18
  • Yep, I did tcpdump -i any – Conrad Sep 25 '13 at 23:27
  • Is eth0 actually the "outside" interface? – Falcon Momot Sep 26 '13 at 1:32

I finally solved the problem myself. After hours of trying almost everything, it was the interface parameter.

so this worked on the old machine

iptables -t nat -A PREROUTING -d $extip -i eth0 -p tcp -m tcp --dport 5777 -j DNAT --to-destination

but on the new machine it works only without -i eth0, even though the interface have the same names

iptables -t nat -A PREROUTING -d $extip -p tcp -m tcp --dport 5777 -j DNAT --to-destination

Thanks to everyone who tried to help.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.