Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm running 3 virtual machines with Fedora 19. The machine B is set up with two networks adapters and provides que channel between machine A and machine C.

The machine A IP is set to and machine C IP is set to On machine B I have one adapter with IP and another adapter with IP

I have to create a rule on machine B in the NAT table that allows an SSH connection to machine A but using the IP external address of machine B.

I've created this rule (don't know if this is correct or not):

iptables -t nat -A PREROUTING -i p8p1 -s -d -p tcp --dport 22 -j DNAT --to-destination

If I only do this, if I use netcat I can't connect to machine A. Now, if i insert this rule:

iptables -A FORWARD -i p8p1 -o p7p1 -s -d -p tcp --dport 22 -j ACCEPT

I can make the connection.

My question is this:

Inserting the second rule doesn't make the first rule unnecessary?

share|improve this question
up vote 2 down vote accepted

The first rule tells the kernel to nat packets coming from for on port 22 to

The second rules tells it to allow packets coming from going to on port 22. This rule is applied after the first has nated the packet, so both are necessary if your default policy is to reject forwarded packets.

ASCII art diagram describing the process:

                      Packet (src -> dst)

machine C |   ->      |
          |                       |                    |
          |PREROUTING: -> (DNAT)|
machine B |                       |                    |
          |FORWARD:            ACCEPT                  |
          |                       |                    |
machine A |  ->        |
share|improve this answer
Yes. My default policy is to reject packets. Many thanks for your explanation – Favolas Oct 19 '13 at 18:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .