Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a linux server in my lab(hereafter called pc1), and I have a windows pc2 where I have a game server running on. But since it's a private network, and the only pc that the internet can access is the pc1. But I want the game server on pc2 be seen by outside internet. But I have no access permission to the router of our lab. So I want the pc1 to act as some kind of router that forwards pc1:port1 to pc2:port2 and backwards. And then the request from outside internet can access pc2:port2 and reply from pc2 can also reach the outside. Is there any method to achieve this?

share|improve this question
If you cannot access the actual router, how will you get it to forward from router:port1 to pc1:port1? – Paul Nov 19 '13 at 5:57

Let us call eth0 the interface (IF) on which pc1 is linked to the router, and eth1 the IF on which pc1 is linked to pc2. You need these commands, issued as sudo, on pc1:

 service network-manager stop
 ifconfig eth0 down
 ifconfig eth0 up
 dhclient eth0
 ifconfig eth1 down
 ifconfig eth1 up
 route add default gw The_IP_Addres_of_Your_Router
 route add -net dev eth1
 echo nameserver >> /etc/resolv.conf
 echo nameserver >> /etc/resolv.conf
 echo 1 >/proc/sys/net/ipv4/ip_forward
 iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE
 iptables --append FORWARD --in-interface eth1 -j ACCEPT

On the Windows machine, you will have to configure a static IP in the range, for instance, and set as your default gateway.

This works on Debian-like systems. If you have another distro you will have to adapt it to your needs. For instance, on Systemd-distros (Arch-Linux, Fedora, SuSE 19..), the first command is systemctl stop network-manager).

The first command disables the networkmanager, which hinders most custom operations. The following 3 commands connect pc1 to your router, and the further commands 5-6 connect pc1 to pc2. Then commands 7-8 set up the routing table, commands 9-10 set up DNS, command 11 enables in-kernel Ipv4 forwarding, and commands 12-13 set up rules for iptables to act as a NAT forwarder, and to accept connections from pc2.

This can be easily scripted.

If you only want to allow communication on certain ports, replace

  iptables --append FORWARD --in-interface eth1 -j ACCEPT


 iptables --append FORWARD --in-interface eth1  -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 iptables --append FORWARD --in-interface eth1 -p Protocol_To_Be_Allowed --sport Port_To_Be_Forwarded -j ACCEPT
 iptables --append FORWARD --in-interface eth1 -j DROP
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .