I have a server with Zentyal 3.03 (Ubuntu 12.04) LTS. It has 3 network devices:

  • eth0 - dhcp fast internet (I pay for it)
  • eth1 - static slow internet (it's free for the school)
  • eth2 - LAN

I can reach the server with SSH, but I can't reach a LAN server from outside. I have set up portforwarding for port 80, it made no sense.

I used:

sudo iptables -A FORWARD -p tcp -i eth1 --sport 8888 -o eth2 -d -dport 8888 -j ALLOW

I don't know what can help, please ask what to show you.

Please help me and do not send me to an another stackexchange website. (this wolud be the 4th time)


You were thinking in a right direction, but used a bit wrong rule.

$ iptables -t nat -A PREROUTING -p tcp -d your_static_ip_of_eth1 \
--dport 8888 -j DNAT --to-destination

This rule will forward all traffic that reaches your server with destination port 8888 and with destination ip of its eth1 interface to your internal webserver. If you wish to change it so your server responds at port 80 then replace the port number of the --dport option. If you like to change the port of webserver then change the port of --to-destination option.

I assume that you secured your system with proper set of iptables rules, but for completeness please consider these rules as well:

-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth2 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8888 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -p icmp -j ACCEPT
-A FORWARD -o eth0 -j ACCEPT
-A FORWARD -o eth1 -j ACCEPT
-A FORWARD -i eth2 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

Also you need the ipv4 routing enabled, so edit /etc/ufw/sysctl.conf and uncomment:

  • I will check it tomorrow morning, then I will accept your answer. I kept trying all day and there was no result and I'm very tired... – androbin Oct 15 '12 at 18:56
  • OP quite possibly needs the FORWARD rule too. OP may need both rules. The nat rule to rewrite the destination, then the FORWARD rule to allow the traffic. In addition, OP may need to turn on IP forwarding. – derobert Oct 15 '12 at 20:41
  • @derobert I assume the OP has forwarding rules in place as his setup is not trivial already. However I will provide one for completeness – Serge Oct 15 '12 at 20:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.