I think I can understand this iptable rule, but I want to make sure what it does, so can someone explain to me technically what this does? well this two rules combined.

/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -d -j DNAT --to-destination

/sbin/iptables -t nat -A POSTROUTING -p tcp --dport 27279 -j MASQUERADE

/sbin/iptables -t nat -A PREROUTING -p tcp --dport 80 -d -j DNAT --to-destination

  • Works with the nat table.

  • Appends the rule to the PREROUTING table so that decisions made in this rule can affect what routing decision gets made.

  • Strictly for connections to port 80 on which is presumably one of this machine's IP addresses.

  • Set the new destination to be port 27279 on If is this machine's IP address, this is needed so that the kernel doesn't think it's the final destination for traffic. At this point the destination IP address in the incoming packet has been altered.

  • -j DNAT just means we're NAT'ing for the destination, rather than obscuring the source of the connection from the destination (which would be SNAT).

/sbin/iptables -t nat -A POSTROUTING -p tcp --dport 27279 -j MASQUERADE

  • Works with the nat table AFTER a routing decision has taken place.

  • Matches any tcp packets destined for port 27279 to and from any IP address. I suppose the idea here is that we don't need to be too specific as that's an uncommon port number.

  • Tells the kernel to MASQUERADE meaning that packets are being modified to obscure either source or destination. This lets response come back through the way they came.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.