Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine ( I can do this via

ssh -L user@localhost

where is bound to eth0.

Now I want to do this without all the userland and encryption overhead.

My guess would be

iptables -t nat -A PREROUTING -i eth0 -p tcp -d --dport 8041 -j DNAT --to

and enable ip-forward - but it does not work.

share|improve this question
Did you add a masquerade rule? iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE – Tim Nov 20 '13 at 17:51

You need to add an SNAT rule as well.

Right now, you have this:

Client ---> NAT box ---> Server
  /|\                       |
   |                       /

That won't work; the client is unaware of the NAT, and so it'll be confused when the reply comes directly from the server. So you need to make the server see the NAT box as the source—which you do by adding a SNAT rule.

Client <---> NAT box <---> Server
share|improve this answer
Just as additional info: Technically that methodology (the return going directly to the client) can work, but it requires using IPVS (via tools such as ipvsadm). – Patrick Nov 20 '13 at 18:22
@Patrick sure, it also requires some cooperation from the server, I believe. – derobert Nov 20 '13 at 18:24
You are correct, it does (adding an IP to the loopback interface and a few sysctl params) :-) – Patrick Nov 20 '13 at 18:26

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.