I want to forward a local port to a remote port (8041) to a port (8042) on a remote machine ( I can do this via

ssh -L user@localhost

where is bound to eth0.

Now I want to do this without all the userland and encryption overhead.

My guess would be

iptables -t nat -A PREROUTING -i eth0 -p tcp -d --dport 8041 -j DNAT --to

and enable ip-forward - but it does not work.

  • Did you add a masquerade rule? iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    – Tim
    Nov 20, 2013 at 17:51

1 Answer 1


You need to add an SNAT rule as well.

Right now, you have this:

Client ---> NAT box ---> Server
  /|\                       |
   |                       /

That won't work; the client is unaware of the NAT, and so it'll be confused when the reply comes directly from the server. So you need to make the server see the NAT box as the source—which you do by adding a SNAT rule.

Client <---> NAT box <---> Server
  • Just as additional info: Technically that methodology (the return going directly to the client) can work, but it requires using IPVS (via tools such as ipvsadm).
    – phemmer
    Nov 20, 2013 at 18:22
  • @Patrick sure, it also requires some cooperation from the server, I believe.
    – derobert
    Nov 20, 2013 at 18:24
  • You are correct, it does (adding an IP to the loopback interface and a few sysctl params) :-)
    – phemmer
    Nov 20, 2013 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.