I currently have a NAS box running under port 80. To access the NAS from the outside, I mapped the port 8080 to port 80 on the NAS as follow:

iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination

This is working like a charm. However, this is working only if I am accessing the website from the outside of the network (at work, at diffrent house, etc). So when I type in mywebsite.com:8080, IPTables do the job correctly and everything is working fine.

Now, the problem I have is, how can I redirect this port from the inside of the network ? My domain name mywebsite.com point to my router (my linux server) from the inside ( but I want to redirect port 8080 to port 80 on from the inside.

Any clue?

Edit #1

Attempting to help facilitate this question I put this diagram together. Please feel free to update if it's incorrect or misrepresenting what you're looking for.

                                     |                   .---------------.
    .-,(  ),-.                       v               port 80             |
 .-(          )-.        port 8080________               |               |
(    internet    )------------>[_...__...°]------------->|      NAS      |
 '-(          ).-'    ^      |               |
     '-.( ).-'                       |                   |               |
                                     |                   '---------------'
                                   __  _ 
  • @slm Exactly. Nothing happen on because the server is on port 80. From the outside, the NAT redirect from port 8080 to port 80 on the specified IP ( NET -> NAT:8080 -> I need the rule from the inside and I don't know what to put there. May 18, 2013 at 20:04
  • @slm Yes. I don't know how I can achieve something like that. I want to say redirect to My rule above is working from the outside, but not from the inside of my network. So if I am at the office, I can access my NAS from website.com:8080 and it's completly transparent. From my home, website.com:8080 point to because it's my router aka Linux server. I want to redirect the port 8080 to the NAS also on port 80 but again, in a transparent way. May 18, 2013 at 23:38
  • @slm Yes, everything is fine and working. I just want to redirect port to from the internal network. May 18, 2013 at 23:44
  • also mention interface like eth0, so that we can able to write iptables use based on inbound interface May 19, 2013 at 5:35
  • Opps sorry, I just saw.. you already solve the issue.. May 19, 2013 at 5:36

4 Answers 4


I finally found how-to. First, I had to add -i eth1 to my "outside" rule (eth1 is my WAN connection). I also needed to add two others rules. Here in the end what I came with :

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 8080 -j DNAT --to
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to
iptables -t nat -A POSTROUTING -p tcp -d --dport 80 -j MASQUERADE
  • 3
    The second rule is not necessary, as the first rule already contains that... Aug 28, 2014 at 9:20
  • 1
    The first rule restricts the preroute only if it's arriving on interface eth1. The second rule is more general as it applies to all interfaces. Beware loops! May 1, 2015 at 5:05
  • This will work as shown IF the FORWARD table is set to ACCEPT by default. If you have a default DROP FORWARD section, you need to add a rule to allow packets to flow; something like iptables -A FORWARD -p tcp --dport 8080 -j ACCEPT.
    – berto
    Jul 18, 2022 at 15:41

You also forgot to mention that package forwarding should be enabled to be able to perform destination NAT. By default, it's usually off, so iptables rules will not work. It can be enabled by issuing:

echo 1 > /proc/sys/net/ipv4/ip_forward
  • Thank you so much for this, I would have been pulling my hair out for hours!
    – ColinM
    Nov 21, 2015 at 6:08

First allow forwarding with

echo 1 > /proc/sys/net/ipv4/ip_forward

Then set iptable rules with

iptables -t nat -A PREROUTING -i $IF -p tcp --dport $PORT_FROM -j DNAT --to $DEST:$PORT_TO
iptables -t nat -A POSTROUTING -p tcp -d $DEST --dport $PORT_TO -j MASQUERADE

You can put these lines into /etc/rc.local for example. Note: since Debian jessie make it executable and enabled the rc.local service via

systemctl enable rc-local.service

First you need to verify that you have the forwarding activated:

cat /proc/sys/net/ipv4/ip_forward

If not 1, run echo 1 > /proc/sys/net/ipv4/ip_forward.

If you want traffic hitting on port 80 and 443 to be forwarded to's 80port then you should use the below rule:

iptables -t nat -A PREROUTING -d -p tcp -m multiport --dports 80,443 -j DNAT --to-destination

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.