Linux Networking Cookbook

Setting up port forwarding

In the previous section, we configured iptables to accept connections to port 22 in order to allow people to SSH into the host. Sometimes, you want to forward a port to a system behind the firewall instead of having the service run on the firewall itself. For example, you may have a web server running on port 8080 on an internal box that you want to expose to the Internet via port 80 on the firewall.

How to do it…

1. Rewrite packets addressed to port 80 to instead go to port 8080:

   # iptables -t nat -A PREROUTING -p tcp -i eth2 --dport 80 \
   -j DNAT --to-destination 192.168.0.200:8080 
   

2. Accept any packets addressed to 192.168.0.200 port 8080:

   # iptables -A FORWARD -p tcp -d 192.168.0.200 \
   --dport 8080 -m state --state NEW,ESTABLISHED,RELATED ...