Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My dedicated server was bridged to vmbr0 and it has 2 Ethernet cards eth0 and eth1 its bridged.

I have enabled forwarding with net.ipv4.ip_forward=1.

I want to redirect the Port 8006 to 443.

Now I'm accessing one of the web applications on port 8006, it want to redirect towards 443 using iptables.

Currently I'm using this rule to forward and its not working:

iptables -t nat -I PREROUTING -d -p tcp --dport 443 -j DNAT --to-destination

If I apply these iptables rules, the page cannot be accessed on

# Default filter

iptables -P INPUT DROP
iptables -P FORWARD DROP

# Loopback allows all.

iptables -I INPUT -i lo -j ACCEPT
iptables -I FORWARD -i lo -j ACCEPT

# Null packets are, simply said, recon packets. see how we configured the VPS and find out weaknesses.

iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Reject is a syn-flood attack

iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# XMAS packets, also a recon packet

iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Allow all Outgoing connection

iptables -A OUTPUT -j ACCEPT
# Ethernet allows established/related Except invalid.

iptables -A INPUT -i vmbr0 -m state --state ESTABLISHE,RELATED -j ACCEPT
iptables -A INPUT -i vmbr0 -m state --state INVALID -j DROP

# Allow TCP on Port 22 SSH with rate limiting

iptables -A INPUT -i vmbr0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -I INPUT -i vmbr0 -p tcp -m state --state NEW -m tcp --dport 22 -m recent --set
iptables -I INPUT -i vmbr0 -p tcp -m state --state NEW -m tcp --dport 22 -m recent --update --seconds 10 --hitcount 5 -j DROP

# Allow Ping ICMP echo With Limiting

iptables -A INPUT -i vmbr0 -p icmp -m state --state NEW -m icmp --icmp-type echo-request -j ACCEPT
iptables -I INPUT -i vmbr0 -p icmp -m icmp --icmp-type echo-request -m recent --set
iptables -I INPUT -i vmbr0 -p icmp -m icmp --icmp-type echo-request -m recent --update --seconds 10 --hitcount 10 -j DROP

# Allow HTTP Requests for NON-secured 80

iptables -A INPUT -i vmbr0 -p tcp --dport 80 -m state --state NEW -m tcp -j ACCEPT
iptables -I INPUT -i vmbr0 -p tcp --dport 80 -m state --state NEW -m recent --set
iptables -I INPUT -i vmbr0 -p tcp --dport 80 -m state --state NEW -m recent --update --seconds 5 --hitcount 20 -j DROP

# Allow HTTP Requests for SLL 443

iptables -A INPUT -i vmbr0 -p tcp --dport 443 -m state --state NEW -m tcp -j ACCEPT
iptables -I INPUT -i vmbr0 -p tcp --dport 443 -m state --state NEW -m recent --set
iptables -I INPUT -i vmbr0 -p tcp --dport 443 -m state --state NEW -m recent --update --seconds 5 --hitcount 20 -j DROP

# Enabling Logging

iptables -N LOGGING
iptables -A INPUT -j LOGGING
iptables -A OUTPUT -j LOGGING
iptables -A LOGGING -m limit --limit 10/min -j LOG --log-prefix "IPTables-log:" --log-level 4
iptables -A LOGGING -j DROP

# DROP ALL Except Above Rules

iptables -A INPUT -j DROP
share|improve this question
judging by this previous answer, I'd say you're missing the FORWARD line: serverfault.com/questions/140622/… – Deryck Jul 5 '14 at 4:57
It's not helped me – Infected Root Jul 5 '14 at 5:12
@Lonston, an (ASCII art) diagram with the network would be nice. Also perhaps the REDIRECT target wold be more appropriate. – Cristian Ciupitu Jul 5 '14 at 19:17

So much to say, but so little was asked. If you want a remote machine to access something on port 8006 you will have to tell your firewall to accept connections on port 8006, but currently you aren't.

Notice, your rule in PREROUTING modifies segments addressed to 443 and changes that destination address to 8006. You are redirecting port 443 to port 8006. However, you state you want to redirect port 8006 to 443. Maybe changing the numbers in your PREROUTING rule does what you want.

Side note: You definetly need to rework your firewall script. It apparently is a copy&paste composition of stuff you found somewhere on the internet. While working (now) this is bound to stop working for you. For instance, you set INPUT's policy to DROP but still have iptables -A INPUT -j DROP at the end of your script. That's redundant and shows you have not given too much thought on the matter. A more critical error is that you enable forwarding, but you have no intention on forwarding ... I think.

share|improve this answer
sync flood, xmas, recon pack these are the rules i copied from digital ocean others are typed for long time by own – Infected Root Jul 6 '14 at 4:03
So what else i have to provide to get fix this ? could you please guide me – Infected Root Jul 6 '14 at 4:03
You need to give a clear description of what you intend to do. Did the numberswapping i suggested help you at all? If not you need to improve your problem description. Not the firewall rules, the problem you want to solve. – Bananguin Jul 6 '14 at 5:27
No the port replacement not supported.. – Infected Root Jul 6 '14 at 6:49
Then "I want to redirect the Port 8006 to 443." is not your only goal. You need to tell us what you have, what you want, what you have tried and what happened during your attempts, especially when you gave up. – Bananguin Jul 6 '14 at 9:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.