On "Server A", I have a service running on port 1445. "Server B" can connect to "Server A" on port 445 via the following rule:

iptables -t nat -A PREROUTING -d www.kunde.de -p tcp -m tcp --dport 445 -j REDIRECT --to-ports 1445

This does not work for connections initiated on "Server A", i.e. local connections. What can I do?


iptables -t nat -A OUTPUT -d www.kunde.de -p tcp -m tcp --dport 445 -j REDIRECT --to-ports 1445

Because locally originated packets go through OUTPUT, rather than through PREROUTING.


You should better read some manuals and docs.

Anyway brief chains description:

* “PREROUTING”: Packets will enter this chain before a routing decision is made.
* “INPUT”: Packet is going to be locally delivered. (N.B.: It does not have anything to do with processes having a socket open. Local delivery is controlled by the “local-delivery” routing table: `ip route show table local`.)
* “FORWARD”: All packets that have been routed and were not for local delivery will traverse this chain.
* “OUTPUT”: Packets sent from the machine itself will be visiting this chain.
* “POSTROUTING”: Routing decision has been made. Packets enter this chain just before handing them off to the hardware.

And take a look here:

Netfilter packet flow



if you use lxc or other virtualization technology, you redirect all traffic from port 445 to container's 1455.

The local request in Server A will not pass PREROUTING. The reason was addressed before. Local traffic will not access nat table, but if you use DNAT before, it only works for outer traffic to Server A, REDIRECT only worked for port forward, it can not be used as DNAT

  • Most of this is either factually incorrect or inaccurate. Please consider reworking this answer. – Felix Frank Jun 13 '14 at 16:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.