Here's my scenario:


There are 3 machines:

A: on the internet : has ip (a.a.a.a), has port pa open

B: my server / gateway : has ip (b.b.b.b), has port pb open

C: on the internet : has ip (c.c.c.c), has port pc open


The owner of machine A offers a service via port pa that must be accessed on machine C via port pc. The problem is, the owner of A can only allow to directly connect with my server, machine B on port pb.

Note that, A and C are on the internet, so in effect, I have to act as a gateway between two machines on the internet (the literature I've found in most firewall docs concerns acting as a gateway between the internet and your local network).


My task is to make sure I give machine C the service offered by A via my server B, in such a way that traffic from A:pa ends up on C:pc and traffic from C:pc ends up on A:pa.

So, how can I achieve this, say using iptables or another Linux / Unix utility? Is it even possible?

Hypothetical Solution:

Here's an Idea I have in mind, but am not sure it's legit or makes sense:

iptables -t nat -A PREROUTING -p tcp --source a.a.a.a --source-port pa \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination c.c.c.c:pc


iptables -t nat -A PREROUTING -p tcp --source c.c.c.c --source-port pc \
--destination b.b.b.b --destination-port pb -j DNAT --to-destination a.a.a.a:pa
  • what does 'on the internet' exactly mean? which of these IPs are RFC-1918 (private)? how does each of the machines reach the other one (A<>B<>C, routing-wiese)? Commented Mar 19, 2013 at 21:15


You must log in to answer this question.

Browse other questions tagged .