Port forwarding using iptables on Linux

Question

I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine (10.0.0.42). I can do this via

ssh -L 10.0.0.41:8041:10.0.0.42:8042 user@localhost

where 10.0.0.41 is bound to eth0.

Now I want to do this without all the userland and encryption overhead.

My guess would be

iptables -t nat -A PREROUTING -i eth0 -p tcp -d 10.0.0.41 --dport 8041 -j DNAT --to 10.0.0.42:8042

and enable ip-forward - but it does not work.

Answer 1

You need to add an SNAT rule as well.

Right now, you have this:

Client ---> NAT box ---> Server
  /|\                       |
   |                       /
    \_____________________/

That won't work; the client is unaware of the NAT, and so it'll be confused when the reply comes directly from the server. So you need to make the server see the NAT box as the source—which you do by adding a SNAT rule.

Client <---> NAT box <---> Server