Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine (10.0.0.42). I can do this via

ssh -L 10.0.0.41:8041:10.0.0.42:8042 user@localhost

where 10.0.0.41 is bound to eth0.

Now I want to do this without all the userland and encryption overhead.

My guess would be

iptables -t nat -A PREROUTING -i eth0 -p tcp -d 10.0.0.41 --dport 8041 -j DNAT --to 10.0.0.42:8042

and enable ip-forward - but it does not work.

share|improve this question
    
Did you add a masquerade rule? iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE –  Tim Nov 20 '13 at 17:51
add comment

1 Answer

You need to add an SNAT rule as well.

Right now, you have this:

Client ---> NAT box ---> Server
  /|\                       |
   |                       /
    \_____________________/

That won't work; the client is unaware of the NAT, and so it'll be confused when the reply comes directly from the server. So you need to make the server see the NAT box as the source—which you do by adding a SNAT rule.

Client <---> NAT box <---> Server
share|improve this answer
    
Just as additional info: Technically that methodology (the return going directly to the client) can work, but it requires using IPVS (via tools such as ipvsadm). –  Patrick Nov 20 '13 at 18:22
    
@Patrick sure, it also requires some cooperation from the server, I believe. –  derobert Nov 20 '13 at 18:24
    
You are correct, it does (adding an IP to the loopback interface and a few sysctl params) :-) –  Patrick Nov 20 '13 at 18:26
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.