Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

mysql real port is 3306

I want public network using 53306 to visit mysql, and 3306 is not allowed access from public network.

How to write the iptables rules DNAT 53306 to 3306?

share|improve this question


iptables -t nat -A PREROUTING -p tcp -d <public IP> --dport 53306 -j DNAT --to-destination

What this rule does is:

  • -t nat indicate the nat table
  • -A PREROUTING meaning append this rule to bottom of PREROUTING chain
  • -p tcp specific this rule only apply for tcp protocol
  • -d <public IP> --dport 53306 meaning match all traffic to public ip and to port 53306.
  • -j DNAT meaning jump to DNAT target
  • --to-destination specify your local ip and port
share|improve this answer
Instead of public IP is also an option, albeit less specific. – 0xC0000022L Jul 1 '14 at 10:27
@gnouc does that actually work? Can you DNAT to an IP that's on the same machine? – Creek Jul 1 '14 at 14:11
@Creek: It's alone may not work, since when packet to localhost simply drop by iptables. I think we need enable route_localnet. – cuonglm Jul 1 '14 at 16:11
@Gnouc Maybe. I was thinking that the packet would traverse the INPUT chain instead of FORWARD and never reach – Creek Jul 1 '14 at 16:17
@Creek You are right, IN IP Secrity Protocol,packet never reach loopback address. – ikool Jul 2 '14 at 3:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.