Actually the same question to this one. But I didn't get answer there either.

My scenario is: a Linux box with two NICs acting as a router, running iptables rules for masquerading, firewall, ... etc. I'd like to forward certain port to internal servers which only have LAN IPs.

The router server uses ppp0 as external interface and as internal IP. I'd like to forward port 2000 from external (connecting to hostname:2000) to internal

The sysctl net/ipv4/ip_forward has been set to 1 since it has masquerade set.

Now when I try port forwarding from external ip (hostname:2000) it is always timed out. In the log I could see the packets being dropped.

The iptables rules is here: https://pastebin.com/au9QDhQf

  • If I setup the port forward to LAN only, i.e., not defined -i $EXT_IF and connect with it could work.
  • I also checked this post. However, since I have already had MASQUERADE set the second rule iptables -t nat -A POSTROUTING -j MASQUERADE does not work here.

Any help will be very appreciated.

2 Answers 2


Since you probably always want to be able to connect to external-ip:2000 from inside your network, you probably don't want `-i $EXT_IF$ in your firewall rule.

My guess is that since you're changing the portnumber in the PREROUTING chain, it doesn't matter that you allow traffic to port 2000, when the traffic reaches that rule, it's probably already been modified so the destination-port is 8088.

  • Sorry, not very clear to me... Removing -i $EXT_IF didn't work, still blocked. Any change suggestion to the rules besides removing assigning the ext interface?
    – Franklin
    Commented Jan 1, 2022 at 12:26
  • Yes. The two paragraphs address different issues. What I suggest (in the second paragraph) you try is t change 2000 t 8088 in the rule(s) that actually allow the traffic. Commented Jan 1, 2022 at 15:10
  • Wondering if this is what you meant: # ------------- Port Forwarding ---------- iptables -t nat -A PREROUTING -p tcp --dport 2000 -j DNAT --to iptables -A INPUT -p tcp --dport 8088 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -p tcp --sport 8088 -m state --state ESTABLISHED -j ACCEPT I still got the packets dropped. Here is the log: block:DROP: IN=ppp0 OUT=ens19 MAC= SRC= DST= LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=21518 DF PROTO=TCP SPT=35934 DPT=8088 WINDOW=64240 RES=0x00 SYN URGP=0
    – Franklin
    Commented Jan 2, 2022 at 1:59

Finally I got what happened.

I put the port forwarding and forward rules in the wrong place -- iptables -A FORWARD -j block was before the port forwarding rules so POSTROUTING was triggered but then the packets were dropped.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .