I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic.

iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport 9750 -j DNAT --to-destination x.x.x.b:9750
iptables -t nat -A POSTROUTING -p tcp --dport 9750 -j MASQUERADE

However, the host x.x.x.a does not open port 9750. Clients do not connect to the server.

cat /etc/sysctl.conf |grep forward
# Uncomment the next line to enable packet forwarding for IPv4
# Uncomment the next line to enable packet forwarding for IPv6
  • 1
    Problem was solved. Helped the following commands: iptables -A FORWARD -d x.x.x.b -i eth1 -p tcp -m tcp --dport 9750 -j ACCEPT && iptables -t nat -A PREROUTING -d x.x.x.a -p tcp -m tcp --dport 9750 -j DNAT --to-destination x.x.x.b && iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
    – vinegret
    Jul 14, 2014 at 13:32

2 Answers 2


I'm not sure what your intentions were with x.x.x.a and x.x.x.b. For the PREROUTING rule you need to specify the external interface and the internal machine's IP:Port.

For port forwarding you don't need a MASQUERADE rule. However, you do need a rule to allow the traffic on the FORWARD chain.

iptables -A PREROUTING -t nat -i [external_iface] -p [proto] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p [proto] -d [internal_ip] --dport [internal_port] -j ACCEPT
  • iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work
    – vinegret
    Jul 14, 2014 at 12:49
  • you're missing the port for the PREROUTING rule, it should be x.x.x.b:port
    – Creek
    Jul 14, 2014 at 13:27

You did not provide packet forwarding configuration, so I hope you missed it. Temporarily you can enable it by:-

 echo 1 >/proc/sys/net/ipv4/ip_forward

To make it permanent open /etc/sysctl.conf and provide this parameter:-

  • cat /proc/sys/net/ipv4/ip_forward 1
    – vinegret
    Jul 14, 2014 at 10:38
  • ok then the chat server, is it tcp itself? I think now its time to do some debugging.
    – beginer
    Jul 14, 2014 at 10:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .