Some firewall models allow port translation. Meaning changing one port coming in (inbound) to some other port, using some protocol. Furthermore, they can also change the internal port to become some external port (outbound traffic) to the original port again.

This is the DMZ external firewall model below. Suppose I want all of this to happen on the server directly using iptables instead of using the DMZ firewall. What commands could allow this to happen on a CentOS 6 server?

DMZ network rule model:

Suppose I have TCP traffic and the public port is 8082 and the internal port is 8081? So for example, Tomcat (the client) in the DMZ would send a TCP packet outside the external DMZ firewall as port 8081, and then the packet would be sent through the internet as 8082 to some public IP. And then the reverse, suppose a request from some public IP was sent to this same server on 8082, and as it entered the DMZ of this server, the port would then change to 8081.

  • public port = 8082
  • internal port = 8081

iptables network rule model:

  • port external to server = 8082
  • port Tomcat is sending and receiving TCP requests on physical server = 8081
  • are you looking for MASQUERADE ?
    – vdegenne
    Jan 27, 2017 at 3:46
  • does this mean it's not possible?
    – MacGyver
    Jan 27, 2017 at 3:59

2 Answers 2


Your solution is to use iptables to define NAT rules.

For my examples, I'll refer to $physicalServerIP which is a local IP and $publicIP for your public IP.

To redirect your Tomcat (assumed on $physicalServerIP) so that its attempts to connect to a server on port 8081 would actually be sent to the server on port 8082:

iptables -t nat -A PREROUTING -p tcp -s $physicalServerIP --dport 8081 -j REDIRECT --to-port 8082

Incoming requests arriving at $publicIP on port 8082 can be sent to $physicalServerIP on port 8081:

iptables -t nat -A PREROUTING -d $publicIP -p tcp -m tcp --dport 8082 -j DNAT --to-destination $physicalServerIP:8081

To complete the previous NAT, direct the packets from $physicalServerIP to be sent (back) through the NAT on the public interface:

iptables -t nat -A POSTROUTING -s $physicalServerIP/32 -j SNAT --to-source $publicIP

With this approach in mind, if you want the whole LAN to be NATed through, you could change the 32 from the previous command to 24 if your LAN is $physicalServerIP/24.


Please try below command to port mapping which help you to hit connection on 8082 and map with port 8081 internally.

iptables -t nat -I PREROUTING -p tcp --dport 8082 -j REDIRECT --to-ports 8081

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.