I need to redirect all traffic incoming on port 9750 (the port chat server) to another machine on the same subnet. Ports clients - dynamic.

iptables -t nat -A PREROUTING -p tcp -d x.x.x.a --dport 9750 -j DNAT --to-destination x.x.x.b:9750
iptables -t nat -A POSTROUTING -p tcp --dport 9750 -j MASQUERADE

However, the host x.x.x.a does not open port 9750. Clients do not connect to the server.

cat /etc/sysctl.conf |grep forward
# Uncomment the next line to enable packet forwarding for IPv4
# Uncomment the next line to enable packet forwarding for IPv6
  • 1
    Problem was solved. Helped the following commands: iptables -A FORWARD -d x.x.x.b -i eth1 -p tcp -m tcp --dport 9750 -j ACCEPT && iptables -t nat -A PREROUTING -d x.x.x.a -p tcp -m tcp --dport 9750 -j DNAT --to-destination x.x.x.b && iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE – vinegret Jul 14 '14 at 13:32

You did not provide packet forwarding configuration, so I hope you missed it. Temporarily you can enable it by:-

 echo 1 >/proc/sys/net/ipv4/ip_forward

To make it permanent open /etc/sysctl.conf and provide this parameter:-

  • cat /proc/sys/net/ipv4/ip_forward 1 – vinegret Jul 14 '14 at 10:38
  • ok then the chat server, is it tcp itself? I think now its time to do some debugging. – beginer Jul 14 '14 at 10:43

I'm not sure what your intentions were with x.x.x.a and x.x.x.b. For the PREROUTING rule you need to specify the external interface and the internal machine's IP:Port.

For port forwarding you don't need a MASQUERADE rule. However, you do need a rule to allow the traffic on the FORWARD chain.

iptables -A PREROUTING -t nat -i [external_iface] -p [proto] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p [proto] -d [internal_ip] --dport [internal_port] -j ACCEPT
  • iptables -A PREROUTING -t nat -i eth1 -p tcp --dport 9750 -j DNAT --to x.x.x.b iptables -A FORWARD -p tcp -d x.x.x.b --dport 9750 -j ACCEPT does not work – vinegret Jul 14 '14 at 12:49
  • you're missing the port for the PREROUTING rule, it should be x.x.x.b:port – Creek Jul 14 '14 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.