Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here's my scenario:


There are 3 machines:

A: on the internet : has ip (a.a.a.a), has port pa open

B: my server / gateway : has ip (b.b.b.b), has port pb open

C: on the internet : has ip (c.c.c.c), has port pc open


The owner of machine A offers a service via port pa that must be accessed on machine C via port pc. The problem is, the owner of A can only allow to directly connect with my server, machine B on port pb.

Note that, A and C are on the internet, so in effect, I have to act as a gateway between two machines on the internet (the literature I've found in most firewall docs concerns acting as a gateway between the internet and your local network).


My task is to make sure I give machine C the service offered by A via my server B, in such a way that traffic from A:pa ends up on C:pc and traffic from C:pc ends up on A:pa.

So, how can I achieve this, say using iptables or another Linux / Unix utility? Is it even possible?

Hypothetical Solution:

Here's an Idea I have in mind, but am not sure it's legit or makes sense:

iptables -t nat -A PREROUTING -p tcp --source a.a.a.a --source-port pa \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination c.c.c.c:pc


iptables -t nat -A PREROUTING -p tcp --source c.c.c.c --source-port pc \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination a.a.a.a:pa
share|improve this question
what does 'on the internet' exactly mean? which of these IPs are RFC-1918 (private)? how does each of the machines reach the other one (A<>B<>C, routing-wiese)? – Oluf Lorenzen Mar 19 '13 at 21:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.