How to do port forwarding/redirecting on Debian?

Question

I have two questions.

Question 1: My debian machine has interface eth3 with ip 192.168.57.28. If someone tries to connect to 192.168.57.28:1234 how do I redirect the request to another machine: 192.168.57.25:80?

Question 2: If my debian machine has two interfaces: eth3 with 192.168.57.28 and ppp0 with some dynamic IP and someone tries to connect via ppp0 on port 1234, how do I redirect the request to 192.168.57.25:80?

I have tried this:

$ iptables -t nat -A PREROUTING -p tcp --dport 1234 -j DNAT --to-destination 192.168.57.25:80
$ echo 1 > /proc/sys/net/ipv4/ip_forward

but it doesn't work.

Daywalker · Accepted Answer · 2013-08-21T10:50:57.727

13

iptables -A PREROUTING -t nat -i eth3 -p tcp --dport 1234 -j DNAT --to-destination 192.168.57.25:80
iptables -A FORWARD -p tcp -d 192.168.57.25 --dport 80 -j ACCEPT
iptables -A POSTROUTING -t nat -s 192.168.57.25 -o eth3 -j MASQUERADE

The first one specifies that all incoming tcp connections to port 1234 should be sent to port 80 of the internal machine 192.168.57.25. This rule alone doesn’t complete the job because iptables denyes all incoming connections. Then we accept the incoming connection to port 1234 from eth3 which connect to the Internet with the publich IP by the second rule. We add the second rule in FORWARD chain to allow forwarding the packets to port 80 of 192.168.57.25.

EDIT: POSTROUTING added.

To keep track of the connection. otherwise the outside host would see the Internal IP 192.168.57.25 which he has no clue of.

EDIT2: Just got the hint that it should be --to-destination instead of --to (sry)

edited Aug 21 '13 at 10:50

answered Aug 21 '13 at 10:18

Daywalker

495
5
25

I have tried your suggestion, but it does not work. I can browse to 192.168.57.25 and the webpage returns, but browsing to 192.168.57.28:1234 does not work. – Dánjal Salberg Adlersson Aug 21 '13 at 10:30
@DánjalSalbergAdlersson Updated my Post (missed something. sry.) – Daywalker Aug 21 '13 at 10:51
3

I tried your suggestion, but it did not work. Then I change to last one to this: iptables -A POSTROUTING -t nat -j MASQUERADE, then it worked! – Dánjal Salberg Adlersson Aug 21 '13 at 11:57
Does this not work in 2020? Error: `iptables v1.8.2 (nf_tables): unknown option "--to-destination"` – user3728501 May 04 '20 at 13:30

score 9 · Answer 2 · answered Dec 29 '15 at 16:50

9

Thanks to Daywalker and Dánjal Salberg Adlersson. After hours of swearing, port forwarding with iptables finally works. (tested on Debian)

bash-script

#!/bin/bash

IPTBL=/sbin/iptables

IF_IN=eth0
PORT_IN=40022

IP_OUT=172.16.93.128
PORT_OUT=22

echo "1" > /proc/sys/net/ipv4/ip_forward
$IPTBL -A PREROUTING -t nat -i $IF_IN -p tcp --dport $PORT_IN -j DNAT --to-destination ${IP_OUT}:${PORT_OUT}
$IPTBL -A FORWARD -p tcp -d $IP_OUT --dport $PORT_OUT -j ACCEPT
$IPTBL -A POSTROUTING -t nat -j MASQUERADE

answered Dec 29 '15 at 16:50

scotty86

191
1
2

is there any reason why "-s 192.168.57.25" was omitted from the POSTROUTING line? – edwardsmarkf Dec 24 '18 at 21:25
also " -o eth3" omitted – edwardsmarkf Dec 24 '18 at 21:57
i see the -s and -o on the POSTROUTING line seems to be optional. any thoughts on using SSL? i asked the question here, referencing your script: https://superuser.com/questions/1387902/iptables-port-redirection-forwarding-and-ssl – edwardsmarkf Dec 26 '18 at 20:17

How to do port forwarding/redirecting on Debian?

2 Answers2

Linked