0

I am new to iptables and I am trying to forward TCP traffic for a specific TCP port to a different host.

I have two machines:

  • 10.250.96.231 (acts as Gateway)
  • 10.250.13.201 (server running the actual TCP service on port 31911)

On the Gateway machine, I verify connectivity to the remote TCP service:

Now, I am trying to enable the desired "forwarding" on the Gateway.

ubuntu@ip-10-250-96-231:~$ sudo sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
ubuntu@ip-10-250-96-231:~$ sudo iptables -t nat -A PREROUTING -p tcp --dport 9999 -j DNAT --to-destination 10.250.13.201:31911
ubuntu@ip-10-250-96-231:~$ sudo iptables -t nat -A POSTROUTING -p tcp -d 10.250.13.201 --dport 31911 -j SNAT --to-source 10.250.96.231
ubuntu@ip-10-250-96-231:~$ sudo iptables -t nat -L 
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       tcp  --  anywhere             anywhere             tcp dpt:9999 to:10.250.13.201:31911

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       tcp  --  anywhere             ip-10-250-13-201.eu-central-1.compute.internal  tcp dpt:31911 to:10.250.96.231

Now, I'm trying to connect to the service through the Gateway (using the Gateway machine):

ubuntu@ip-10-250-96-231:~$ telnet 10.250.96.231 9999
Trying 10.250.96.231...
telnet: Unable to connect to remote host: Connection refused
ubuntu@ip-10-250-96-231:~$ telnet localhost 9999
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused

As you can see I can't get any connection. Am I doing it right?

  • testing from the host which is doing nat requires OUTPUT, not PREROUTING which is used when routing – A.B Jun 7 '18 at 23:53

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.