I want to trigger a wake up on a target machine, wich is behind a firewall. The signal for this is a magic packet to the 9/udp port.

My signal goes through the router and reaches a Debian server with two ethernet interfaces. Here it is the '/etc/network/interfaces' file:

iface eth0 inet static (-->router)

iface eth1 inet static (-->local lan)

And here it is the result of the command 'route -n':

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         UG    0      0        0 eth0   U     0      0        0 eth0   U     0      0        0 eth1

Finally, these are the rules of iptables to make dnat:

iptables -A INPUT -p udp --dport 9 -i $RUTER_IFACE -j ACCEPT
iptables -A OUTPUT -p udp --sport 9 -d $LAN_NET -j ACCEPT
iptables -t nat -A PREROUTING -i $RUTER_IFACE -p udp --dport 9 -j DNAT --to $TARGET
iptables -A FORWARD -p udp --dport 9 -i $RUTER_IFACE -o $LAN_IFACE -j ACCEPT

Well, I've checked out the traffic and I've seen that the magic packet reaches the eth0 interface. Also, if the value of $TARGET is one IP address (for example,, the packet goes from eth0 to eth1 and reaches the target machine ( However, if the value of $TARGET is a range of IPs (for example,, the packet doesn't go from eth0 to eth1 and doesn't reach the target machine.

I need to put a range of IPs (not one IP address), because of the magic packet is not sent to a IP but to a MAC address. Additionally, the machines in the local lan don't have static IPs. The dnsmasq daemon (in the Debian server) leases the IPs to the local machines.

Well, I think that the problem is the routing in the Debian server. But the fact is that I don't konw how to solve. I would thank your help.

I am sorry because of my bad english. Thank you very much.

1 Answer 1


I think what you want to achieve is called "subnet directed broadcast" whereby the Wake-on-LAN packet will be forwarded to every device running behind your router, and the device will wake up if the information in the WoL packet matches it.

First: The first two iptables lines are just required if your server/router itself should be woken by WoL (line 1) and also send WoL-packets (line 2). If you only want to send WoL-packets from the 'outside' to hosts behind the router, you wouldn't need those two lines.

Second: The WoL-packet should be forwarded to the “broadcast address,” which will broadcast the packet to all computers on the network. Therefore $TARGETshould be set to

Also, you need to have IPv4 forwarding enabled.

The last iptables command is only required if you have any rule which would drop such a packet or a 'DROP' policy in your FORWARD chain.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .