I have the following rules working fine - before I added a private network with a single VM (which can ping all machines on the host but not the outside). I want the VM ( to reach the internet and enable a forwarding so I can connect to it via SSH. (Which only works without my rules I already have) IP forwarding is enabled.

The iptables rules I have so far:

-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables    INPUT:DROP: "
-A FORWARD -m physdev --physdev-is-bridged -j ACCEPT
-A OUTPUT -p icmp -j ACCEPT

When ever I load the above rules and then load the following, the internal VM cannot reach the internet - but I can connect to it via the port forwarding:

iptables -t nat -A POSTROUTING -s -o br0 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -i br0 --dport 22727 -j DNAT --to-destination
iptables -A FORWARD -p tcp -d --dport 22727 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Any hints what I am missing?

1 Answer 1


The problem might be that web packets returning from the internet are dropped by the INPUT chain, as the dport is a random one (and not always 22727)

You can try with:

iptables -I INPUT 2 -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT


You also need to enable ip forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward

  • But doesn't my rule -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT match this behaviour? Feb 19, 2016 at 10:32
  • Tried with this and different solutions but it doesn't work :/ Sorry. Feb 19, 2016 at 11:40
  • I guess you did but, did you also enable IP forwarding in /proc/sys/net/ipv4/ip_forward
    – martintama
    Feb 19, 2016 at 12:43
  • Yes, it is/was enabled. Feb 19, 2016 at 13:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.