Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to redirect a certain port range in a linux host to one of its guest VMs. I would like for this redirection to apply to all the host's interfaces, including localhost. I was able to do:

iptables -I FORWARD -m state -d --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -t nat -I PREROUTING -p tcp --dport 8000:8500 -j DNAT --to

Where 8000:8500 is the range I am interested in forwarding and is the guest's IP. This works as long as I am trying to connect from another machine, i.e. not the VM host. But I would also like to be able to forward traffic that originates inside the VM host.

Hope that is clear, sorry if I mangled the terminology.

share|improve this question

migrated from May 11 '13 at 1:41

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

Apparently performing DNAT for loopback traffic is not possible — e.g., see this question, or this debian-user discussion. Using REDIRECT works because traffic stays on the loopback interface, but forwarding the traffic to another machine does not work.

You could use a userspace program to forward TCP connections — e.g., xinetd with the following configuration will forward port 8000 to your VM:

service forward_8000
        type                    = UNLISTED
        port                    = 8000
        socket_type             = stream
        wait                    = no
        user                    = root
        redirect                = 8000

However, it is not possible to redirect a range of ports this way — every port needs a separate service definition.

share|improve this answer
Thank you. I found rinetd which is slightly easier to setup than xinetd for this amount of ports. I am awarding you the bounty since you provided as close to an authoritative answer as I am likely to get. take care. – samwise May 15 '13 at 19:44

Local packets will not enter the PREROUTING chain. I believe you will need to use the OUTPUT chain in the NAT table to do that:

iptables -t nat -I OUTPUT -p tcp --dport 8000:8500 -j DNAT --to

You will possibly also need to add a rule to the filter chain that allows these outbound and their related packets:

iptables -I OUTPUT -m state -d --state NEW,RELATED,ESTABLISHED -j ACCEPT
share|improve this answer
That does not seem to work. I get the same result, i.e., telnet localhost 8000 is unable to connect (I have something running on VM on port 8000) – samwise May 10 '13 at 22:45
You may also need to add a rule to allow the packets out. (The counterpart of your FORWARD rule.) I recommend you check your packets with tcpdump so you see what's actually happening. – Janoszen May 10 '13 at 22:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.