I have StatsD daemon running on a remote server (x.x.x.x) at 8125. I would like to forward to x.x.x.x:8125.

I have already tried running the following on localhost

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p udp --dport 8125 -j DNAT --to x.x.x.x:8125
iptables -t nat -A OUTPUT -p udp --dport 8125 -j DNAT --to-destination x.x.x.x:8125
iptables -t nat -A POSTROUTING -d x.x.x.x -j MASQUERADE

But it is not forwarding correctly.

echo "test.test.test:1|c" | nc -w 1 -u localhost 8125

Fails with error nc: Write error: Connection refused

echo "test.test.test:1|c" | nc -w 1 -u 8125

Fails without any error

echo "test.test.test:1|c" | nc -w 1 -u x.x.x.x 8125

Works correctly

Also, will such a port forwarding cause any security issues?

1 Answer 1


That's not possible.

Packets generated by local processes are not involved in the forwarding plan.

As a consequence you won't be able to use PREROUTING and FORWARD chains in the tables locally generated packets will go through, but only OUTPUT (in raw/mangle/nat/filter tables) and POSTROUTING (in mangle/nat tables) chains while the routing decision is already made and you can't change it.

In fact with your current iptables setup your rules will do the following considering your use case :

  • First rule : unreached.
  • Second rule : DNAT locally generated packets to x.x.x.x on the loopback interface.
  • Third rule : Masquerade packets going trough your loopback interface with the IP address of your loopback interface.

So the result is : local packets will try to reach x.x.x.x:8125 on your loopback interface.

This netfilter diagram can help you understand the location of locally generated packets in the global flow.

  • Thank you Xavier. My knowledge in networking is very limited, and I couldn't understand much from the the netfilter diagram. So, what are my options to forward local udp port to a remote server? SSH Tunneling?
    – Joyce Babu
    Dec 1, 2014 at 13:14
  • @JoyceBabu You can do that directly with a fifo and netcat : nc -ul -p 8125 < /tmp/fifo | nc -u x.x.x.x 8125 > /tmp/fifo Dec 1, 2014 at 14:12
  • This is for a live web server. Would such a setup open up any security issues? Also, will it stay open permanently if I add it to cron to run at @reboot using nohup?
    – Joyce Babu
    Dec 1, 2014 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.