For example, you may want to forward some obscure port on an external facing host to Apache Tomcat on an internal host.

The cases for this are rare… but I’ve found it convenient from time to time for temporary setups such as for testing or demonstrations. In more complex situations, you might want to have an incoming port on a host directly connected to both an internal and external network forwarded to a separate internal network host.

Iptables -t nat -A PREROUTING -p tcp -dport -j REDIRECT -to-port iptables -t nat -A PREROUTING -p tcp -dport 1234 -j REDIRECT -to-port 80 Complex Port Forwarding Instead of having Apache listen on the obscure port and creating a customized virtual host, I often just use iptables to redirect traffic from the obscure port to the standard port. For example, you may want Apache httpd available on your internal network at port 80, but externally on some obscure port for a host that is directly connected to both networks. This can be helpful if you want a particular service available on different ports internally and externally for the same host. I find myself going back to my notes and code snippets somewhat frequently to jog my memory on the format of these patterns, and felt it might be helpful to share them.įor the purposes of my examples, let’s say we have the following setup: These generally involve NAT and Port Forwarding, and use not the filter table, but the nat table. Over time, I have come to use a few patterns that go beyond the simple “allow this” or “block everything but”. I make use of netfilter/iptables quite frequently - most system admins probably do.

Iptables dport