Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd like to redirect local requests to port which is translated with NAT. I have following rules:

iptables -t nat -A PREROUTING -p tcp --dport 9020 -j DNAT --to

however request coming from localhost are rejected:

Connecting to failed: Connection refused.

When I'm connecting from any other computer it works. Is there a way how to do this without recompiling kernel with CONFIG_IP_NF_NAT_LOCAL=y? https://wiki.debian.org/Firewalls-local-port-redirection (which seems to be obsolete).


iptables -L -v -n --line-numbers -t nat:

Chain PREROUTING (policy ACCEPT 26 packets, 3230 bytes)
num   pkts bytes target     prot opt in     out     source            destination    
4       0   0     DNAT      tcp  --  *       *   tcp dpt:9020 to:

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source                destination         
1        0     0 MASQUERADE all  --  *       *  
share|improve this question
The -i eth0 prevents this rule to be applied to local connections. Just omit it. – Hauke Laging Feb 4 '14 at 17:23
I've already tried this, it doesn't help. – Tombart Feb 4 '14 at 18:44
It doesn't solve the problem here for me but PREROUTING is wrong in any case. The rule must be put in the OUTPUT chain. PREROUTING is for packets from the outside which arrive at the host. – Hauke Laging Feb 5 '14 at 1:10
You're right, thanks. Write it as an answer and I'll be happy to accept it :) – Tombart Feb 5 '14 at 10:05
Does that solve the problem for you? It didn't for me which is the reason why I did not write this as an answer. – Hauke Laging Feb 5 '14 at 11:20
up vote 4 down vote accepted

Based on @Hauke Laging comments I put together this:

# connections from outside
iptables -t nat -A PREROUTING -p tcp --dport 9020 -j DNAT --to
# for local connection
iptables -t nat -A OUTPUT -p tcp --dport 9020 -j DNAT --to

# Masquerade local subnet
iptables -t nat -A POSTROUTING -s -j MASQUERADE
iptables -A FORWARD -o lxcbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i lxcbr0 -o eth0 -j ACCEPT
iptables -A FORWARD -i lxcbr0 -o lo -j ACCEPT

where lxcbr0 is interface in subnet and eth0 is interface with public IP addrees.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.