I'm posting here because I've got a server, and I want to redirect the port 2121 of my main interface (eth0) to the port 21 of my secondary interface (virbr0).

This is my configuration :

Physical server OS : Ubuntu Server 16.04 LTS, 
Firewall software : UFW v.0.35 
Virtual Machine OS : Windows 7 Professional
Hypervisor : OpenStack KVM (QEMU).

Server IP configuration :

        address 91.121.XXX.XXX
        network 91.121.XXX.0
        broadcast 91.121.XXX.255
        gateway 91.121.XXX.254


Server Routes configuration :

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface         91.121.XXX.254         UG    0      0        0 eth0
91.121.XXX.0   U     0      0        0 eth0   U     0      0        0 virbr0

UFW configuration :

I have followed these instructions : 
NAT and FORWARD with Ubuntu’s ufw firewall - https://gist.github.com/kimus/9315140

VM IP Configuration :

IP address :

This is that I want to do :

redirect 91.121.XXX.XXX:2121 to (VM).
eth0:2121 -> virbr0:21

Note : The VM is connected to the Internet, for some reasons, I want to access at the FTP (Typsoft) Server installed on it on port 21 .

The port 21 of my server is already on use by an other thing. And I want use the port 2121 to access the ftp server present on the VM.

Can you help me ?


I've never used UFW for my iptables configuration. I've always used cmd-line iptables/bash scripts to accomplish my firewalling. So my answer here is going to be in that format.

This rule is to accomplish the NAT you want:

iptables -t nat -A PREROUTING -d 91.121.XXX.XXX -p tcp --dport 2121 -j DNAT --to

What it does is accept TCP connections on IP 91.121.XXX.XXX:2121 and NAT them to your VM on port 21.

Assuming your FORWARD policy is set to DROP, you'll also have to make sure you're allowing connections to your VM from the outside via:

iptables -A FORWARD -d -p tcp --dport 21 -j ACCEPT

Both of these rules are REQUIRED in order for NAT/forwarding to work properly in your scenario (although, if your FORWARD policy is ACCEPT then the second rule in the FORWARD chain is unneeded).

If these don't work, then please post the output of iptables -vnL as well as iptables -t nat -vnL and I can assist further.

Hope this helps.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.