I need to build a bridge between two network ports on a server so everything that arrives on port A goes to port B and everything that arrives on port B goes to port A.

I have two devices (dA and dB) that are behind different NATs in different networks, both can make any outbound connection, however all inbound connections are blocked. So they cannot connect directly. It is not possible to configure any port forwarding on those NATs.

So I will put a server S that can listen on all networks ports. It accepts connections on ports A and B and creates a bridge between then, so the traffic flows from A to B as if they were connected directly.

The final result I want to archive is:

  1. Device dA connects to server S on port A. Eg. it connects to server.com:A
  2. Device dB connects to server S on port B. Eg. it connects to server.com:B
  3. dA talks with dB through S

Is there any way of doing that using a Linux server? The server runs a Linux based on Debian wheezy.

It would be great to do it using commands/command line tools, so, if needed, the ports can be changed without editing any file (using an script).

  • I think you mean router, not bridge. A bridge is for combining pieces of a network into one large network; all of the devices would need to be on the same subnet. A router lets different networks communicate through it. You would then need to set routes on the devices telling it to reach the other network via S.
    – user143703
    Mar 26, 2014 at 4:56
  • Well, bridge may not be the best word, neither is router... I do not want to connect two different networks, what I wat is to bypass two firewalls/NATs to connect a pair of softwares (or many pairs) using one machine/server withna fixed IP address. I have heard that it is possible to be done, however I am not sure how.... Mar 26, 2014 at 13:01
  • It has got something to do with emulating serial ports and connecting them to the TCP ones. Mar 26, 2014 at 13:12
  • anyone reading this question later, search for tcp hole punching, it may work for you.
    – Behrooz
    Sep 7, 2016 at 21:03

4 Answers 4


The tool socat does what I need in a simple way.

socat  TCP4-LISTEN:5060,reuseaddr TCP4-LISTEN:5061,reuseaddr

It blocks the terminal, however it is the best solution I could found.


You can do this with xinetd using its redirect directive. I personally prefer this to using socat because xinetd the configuration is in an obvious place (making it easier to manage with Puppet or Chef) and will automatically be started at boot time.


You seems to be talking about reverse proxy. There are many useful daemons (specifically SOCKS proxies) but you look for a commandline solution.

This can be achieved with ssh port forwarding. You may forward a port with:

user@dA:~$ ssh -R :1111:localhost:1111 user@server.com

It will open port :1111 on server.com. After accepting connection on that port ssh will forward this request to the dA and make a connection locally on dA to localhost:1111 forwarding all traffic over existing ssh channel.

So while your ssh session is up and running every host connecting to server.com:1111 will effectively connect dA:1111

Please note the starting semicolon. It means that server.com should accept external connections (by default it will only listen for connections from localhost).

You will also need to enable GatewayPorts option in ssh config on server.com. Otherwise sshd will not allow to accept external connections.

  • The ssh command did not work, it worked as a normal port forwarding... SOCKS proxies also did not seem to be what I want. Anyway in the end I found a solution: socat Mar 28, 2014 at 19:01
  • This example is not a regular port forwarding. It's tunnelling. It accepts connections on one side of ssh session and transfers them to another. It does not merge two connections to one as you wanted but makes possible to connect two firewalled machines. One is connected with ssh and one with plain TCP.
    – nARN
    Mar 31, 2014 at 15:02

Why don't you use iptables?

iptables -t nat -I PREROUTING --src $SRC_IP_MASK --dst $DST_IP -p tcp --dport $portNumber -j REDIRECT --to-ports $rediectPort
  • It did not work. As far as I understand it is a port forwarding, which is not what I am looking for. Mar 28, 2014 at 18:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.