I need to forward traffic coming into a cloud-provisioned Ubuntu VPS at on port 1234 to port 5678 on local Windows computer (, which is behind a router at /, but to preserve the originating IP address. The router forwards port 5678 to the Windows machine.

When I run this on the VPS:

iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination iptables -t nat -A POSTROUTING -p tcp -d --dport 5678 -j SNAT --to-source

This works to forward the packets, but the server at thinks everything is coming from The originating IP is lost.

Question 1: can I accomplish what I need with just iptables on the VPS? (I think the answer is No, but I'd love to be wrong.)

Question 2: can I manipulate iptables and/or routes on the router at to accomplish this? What do I need to add to the router's iptables, and what do I need to change in the VPS's iptables?

  • 1
    Why are you doing SNAT here? – Tero Kilkanen Apr 20 '19 at 10:04
  • You'll have to use a tunnel because is not in the path between the random client and the windows system. – A.B Apr 20 '19 at 11:51
  • Would the SNAT work if I told the router to route all traffic from back to – ras Apr 20 '19 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.