Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want a service to be running on every external port on my system. Since it wouldn't work to start 65535 single instances of that service (I guess...) I thought of using iptables for this.

The service (just a 10 line Python script) is listening on localhost:10000. iptables should now forward every TCP-request on an external port to this local port so that each of these ports seems to be open. I have only few experiences with iptables and no time to read more about this subject, so I cannot quite get this to work.

I tried:

iptables -A PREROUTING -t nat -i eth0 -p tcp -j DNAT --to-destination

But when scanning from within the local network all the ports appear filtered, not open. There are no other rules currently active and the policies are all set to ACC

How can I get that right?

Thanks in advance!

share|improve this question
Here's a link to an more recent answer:… – Warren T. May 16 '14 at 4:32

2 Answers 2

up vote 3 down vote accepted

Since your polices are ACCEPT, you can use your iptables line with 2 changes:

  1. add destination port range with --dport 1:65535
  2. change the with your interface IP (the IP of eth0)

for example, this line works if your eth0 IP is

iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 1:65535 -j DNAT --to-destination

all connections to (to any port) will be redirected to port 10000.

Edit: You can use the REDIRECT target too:

iptables -t nat -A PREROUTING -p tcp --dport 1:65535 -j REDIRECT --to-ports 10000

this still will not help you if you listen to localhost only.

share|improve this answer
Works well if the server listens to the external interface. Thanks! Is it possible to perform the redirection to a port on localhost, so I can run the server locally? – j0ker Jun 23 '12 at 7:12
IIRC the nat table is made to work with external interfaces. If there is a way to redirect to localhost (or in that matter to different interface), it would imply enabling the forwarding (echo 1 > /proc/sys/net/ipv4/ip_forward) and may be nat-ing the forward and backward traffic (or even source route). I do not see the point of doing this, since your service will be accessible on external interfaces. There is no point making it listen to localhost only. – 0xAF Jun 23 '12 at 13:15
The point is convenience in writing the server script. My local IP stays the same, whereas the eth0 IP changes with the network. – j0ker Jun 23 '12 at 13:42
Then use the REDIRECT target. See my edited answer. This way you will use one universal iptables line. And your service can listen to "" (all interfaces), so even if the ip changes, this wont hurt your service. (Edit: please accept the answer if you find it correct.) – 0xAF Jun 23 '12 at 14:16

Here's a link to a more recent answer:

This one really helped me out.

share|improve this answer
Rather than linking to a page, which might go away in the future, please summarize your answer here and also provide the link as reference material. – Kevin Panko May 16 '14 at 5:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.