Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have two machines in my network (A and B), where A is the one directly accessed from outside when calling my IP address and B is a very powerful one which should serve for very intensive tasks.

I would like to forward a certain port, e.g. 9090, from A to B, so any request sent to A on port 9090 is directly forwarded to B.

How can that be achieved?

(Should any answers contain IP addresses for A or B, please use 192.168.2.A/B respectively)

share|improve this question
Why not forward all traffic coming in to your router on port 9090 to 192.168.2.B:9090? –  Kruug May 7 '13 at 20:10
@Kruug I'd actually recommend doing that instead, in the absence of a reason why not; forwarding from the router to A, and then from A to B, introduces an additional layer of complexity which needs to be justified. On the other hand, I assume the person asking the question has a reason to do it this way; perhaps he can't administer the router, but has root on machine A and can therefore modify iptables rules there. (Of course, if he can't administer the router and doesn't have root on machine A, he's SOL.) –  Aaron Miller May 7 '13 at 20:19
The reason is that only port 9090 should be accessable by the outside world. All other ports shall only be accessable via the internal network –  MechMK1 May 7 '13 at 20:42
add comment

1 Answer 1

up vote 1 down vote accepted

This page describes in great detail how to do what you're after. The salient commands, to be executed on machine A, are these:

root@A # iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 9090 -j DNAT --to 192.168.2.B:9090
root@A # iptables -A FORWARD -p tcp -d 192.168.2.B --dport 9090 -j ACCEPT

The first command creates an iptables rule which will reroute packets coming into machine A's port 9090 to go to machine B's port 9090; the second rule permits such packets to be forwarded to machine B. (The second rule may not be necessary depending on the policy set for the FORWARD chain on machine A, but it doesn't hurt to add; if it's not needed, it will simply do nothing.)

Note that these changes will not persist across reboots unless explicitly set up to do so. Different distributions handle this in different ways; if you're unable or unwilling to use whatever method your distribution defines, you can do

iptables-save > /etc/network/iptables

(or some similar such file if not /etc/network/iptables), and then add the following to /etc/rc.local:

iptables-restore < /etc/network/iptables

(using the same path as given in the iptables-save command) in order to reapply the changes on boot.

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.