Let me open by saying I have scoured the internet, even companies I purchased the software from and it's been 5 months!! So I am turning to the community as my eyes and brain are bleeding from reading and trying this long getting no where. In short, can this be done, YES. Apparently I am too stupid to do it, however at least I have a huge knowledge of iptables now :-)

My requirement: I use protonmail for my email. If you didn't know, it's so secure, that you have to run a "bridge software" running on each machine that needs to send/receive email. I simply want to send emails from myself, to myself, for my smart home, cameras, alerts, etc etc. As you can imagine I can not install this software on 20 devices let alone cameras!!! So I need a single linux server running this software to act as the email "hub"

My network is no vlans, no complications (pfsense as my router/firewall)

I am using mxlinux / debian as my "email host" IMAP is listening on port 1143 SMTP is listening on port 1025

All I wanted to do was make it so that ANY device on my network can use to send emails using SMTP on port 1025. Thought this would be easy..but noooooooooooooooooooo simply because the damn software will ONLY listen on !!! I can not change it to something like etc.

First you should know I contacted protonmail directly as it's a paid email service they actually have techs that know what they are doing and talk with you. However, they feel it's a "security risk" to allow their service to listen on so the code will not allow this to be changed. I did the below on the "email server /"

  1. Edited /etc/sysctl.conf and uncommented the # in front of net.ipv4.ip_forward=1

  2. Updated iptables

    sudo iptables -t nat -A PREROUTING -i eth0 -p tcp -s --dport 1025 -j DNAT --to-destination 
    sudo iptables -t nat -A POSTROUTING -o lo -p tcp --dport 1025 -j SNAT --to-source
    sudo iptables -A FORWARD -i eth0 -o lo -p tcp --dport 1025 -j ACCEPT
  3. Make my entries save on reboot and it's going to ask me if I want to save my above tables, I need to say yes, so I will:

    sudo apt install iptables-persistent
  4. Go into MX "firewall configuration" and turn off "public, private and office", basically turn off the firewall

  5. Reboot the computer

OK now listing out after a reboot it looks like this. I tried from a windows computer on my network to telnet and as you can see I am seeing packets but it's not working :-( :-( :-( :-( :-( :-( :-( :-( :-( :-( :-(

sudo iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 15748 packets, 1719K bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   260 DNAT       tcp   --  eth0  * tcp dpt:1025 to:

Chain INPUT (policy ACCEPT 15748 packets, 1719K bytes)
 pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 730 packets, 73256 bytes)
 pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 730 packets, 73256 bytes)
 pkts bytes target     prot opt in     out     source               destination

    0     0 SNAT       tcp  --  *      lo   tcp dpt:1025 to:

This is me testing the service on the local host email computer

$ telnet 1025
Trying Connected to
Escape character is '^]'.
220 ESMTP Service Ready

Notice the dropped packets in eth0 received side

$ uname -a
Linux email 5.10.0-23-amd64 #1 SMP Debian 5.10.179-2 (2023-07-14) x86_64 GNU/Linux

bob@email:~ $ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
        inet netmask broadcast
        ether 00:0c:29:63:d5:4f txqueuelen 1000 (Ethernet)
        RX packets 126620 bytes 24077186 (22.9 MiB)
        RX errors 0 dropped 6447 overruns 0 frame 0
        TX packets 30080 bytes 3728557 (3.5 MiB)
        TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
        inet netmask
        loop txqueuelen 1000 (Local Loopback)
        RX packets 57 bytes 4931 (4.8 KiB)
        RX errors 0 dropped 0 overruns 0 frame 0
        TX packets 57 bytes 4931 (4.8 KiB)
        TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

None of the above worked so I tried different variations. I also found a command I was suggested to use that did not seem to help but tried it anyway.

sysctl -w net.ipv4.conf.eth0.route_localnet=1
  • 1
    In the second iptables rule I'm fairly sure that --dport should be --sport so that it mangles outgoing response traffic Jul 31, 2023 at 15:45
  • Frank, please don't post the same question in two places. Delete one of them (at least until you don't get an answer on the other) Jul 31, 2023 at 21:20
  • @roaima thank you so much for the reformat! This is my first post, I didn't know I could do this let alone how. Again thank you!
    – Frank
    Aug 1, 2023 at 14:59

1 Answer 1


An alternative approach is to use an application forwarder. No iptables or kernel level forwarding is required. In this example I've used socat, but other possibilities may exist. Here the set of permitted source IP addresses is defined as an application argument.

socat TCP-LISTEN:1025,fork,range=,reuseaddr,bind= TCP4:

Here, we've two sets of arguments:

  1. Listening address

    • LISTEN:1025 - Listen on this port
    • fork - Fork a subprocess to handle each inbound request
    • range= - Accept requests from devices in this network range
    • reuseaddr - Allow rapid reuse of address/port tuples
    • bind= - Listen on this address (your eth0)
  2. Forwarding/relay address

    • TCP4: - Relay to this address:port
  • I will give socat a try, thanks for the tip. After a quick read on socat, I am unsure on the deepest layer of linux kernel processing; meaning will socat actually send and receive packets redirected to or would I still need to use one or both commands as I did above: sysctl -w net.ipv4.conf.eth0.route_localnet=1 or net.ipv4.ip_forward=1
    – Frank
    Aug 1, 2023 at 14:55
  • you are a demi god....thank you! I simply installed socat and used your one liner of: socat TCP-LISTEN:1025,fork,range=,reuseaddr,bind= TCP4: Do you have a buy a coffee thing or some way I can show my appreciation to you?!
    – Frank
    Aug 8, 2023 at 18:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .