I have a scenario: I have 4 server and 3 web inbound requests that I have to allow through a modem/router. the ports are https(ssl)443 ssh22 and http80. All 4 servers want them.

I had set up the server to use port forwarding and remapping like this:

2241->port 22 on ip
2242->port 22 on ip
2243->port 22 on ip
2244->port 22 on ip

and so on using 44341(..2..3..4) and 8041(..2..3..4)

I love this set up. Behind the firewall I can use default ports ( I prefer this), from outside I can (as I need to) colon:in.

However two things happened. The modem old router died I bought a new one (expensive) this new tech didn't allow more than 8 ports to be remapped. Bad. Artificial glass ceiling. I then set it up at the customers offices > I went to the customer theirs didn't even have any port forwarding at all, so I bought them a brand new modem router (even more expensive) fearing it would need to do more than 8 ports, and fearing that this kind of port remapping role is now a "premium" feature. I was wrong. The *even*more* expensive new modem router will only allow the ports to be forwarded flatly, it won't allow the ports to be remapped. just forward them on.

SO I digressed massively . But is there a way I can still have port remapping I thought to myself?

can I use something like the following to help me?

iptables -t nat -A PREROUTING -i eth0 -p TCP --dport 2202 -j REDIRECT --to-port 22

is there any reason to avoid this use?

  • On what machine are you thinking of running iptables?
    – Julian
    May 13, 2012 at 20:27

2 Answers 2


As your router does not support port mapping, you can do this either on each hosts for itself or by one host.

To forward incoming traffic on port 2241 to localhost:22, use

iptables -t nat -A PREROUTING -p tcp --dport 2241 -j REDIRECT --to-ports 22    

To forward incoming traffic on to you can use DNAT (Destination NAT). You can do this for example by using (there are probable more secure solutions):

echo 1 > /proc/sys/net/ipv4/ip_forward # or use /etc/sysctl.conf
iptables -t nat -A PREROUTING -p tcp --dport 2242 -j DNAT --to-destination 
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -P FORWARD DROP
iptables -A FORWARD -d -p 22 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
  • this is an excellent solution, but it'll need to be stored so it preserves on reboot
    – conners
    May 15, 2012 at 20:06
  • @conanman Create a script and call it from /etc/rc.local (depends which distribution you use).
    – jofel
    May 16, 2012 at 11:08
  • I have "fixed it" I was using openSUSE. ok check the answer
    – conners
    May 17, 2012 at 9:02
  • # iptables -t nat -A PREROUTING -p tcp --dport 2241 -j REDIRECT --to-port 22 # iptables-save > /root/dsl.fw OPENSUSE # echo "iptables-restore < /root/dsl.fw" >> /etc/init.d/boot.local CENTOS RHEL # echo "iptables-restore < /root/dsl.fw" >> /etc/rc.local
    – conners
    May 17, 2012 at 13:18

If you are planning on replacing the router with a linux router thats fine. I like tomato for this but freesco, ddwrt and openwrt will do the job. They will provide a web gui like you are familiar with on a product, use iptables to implement it, and give you the high end features on low-end hardware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.