I am using an Ubuntu 16 server.

I am trying to use iptables to forward a port from a particular network adapter and port to a specific port on lo/ It seems like the correct tool.

By way of an example, let us imagine I want adapter ens192 to forward incoming traffic on port 8443 to I do not want ens192's 443 to reach it should appear closed.

I've made the following calls (as sudo su, for convenience) on a fresh install:

# sysctl -w net.ipv4.ip_forward=1  # permits port-forwarding
# sysctl -w net.ipv4.conf.ens192.route_localnet=1  # permits routing adapter 2 localhost
# iptables -P INPUT DROP
# iptables -t nat -A PREROUTING -i ens192 -p tcp --dport 8443 -j DNAT \
# iptables -t nat -A POSTROUTING -o ens192 -j MASQUERADE

However, this doesn't work... browsing to [ip]:8443 doesn't yield the desired results... the browser times out.

I have validated that the server is running properly at the desired port.

I assume that the browser's TCP request changes within the server to appear as if it contacts instead. Then, when responding, the IP address translates back to the address/port of ens192 instead as it leaves. Or... not?

  • "Seems like the correct tool" and "is the correct tool" differ here. I suspect iptables doesn't nat different ports well. If at all. So the better tool is apache2's configuration files, most likely. Feb 22, 2017 at 15:51

1 Answer 1


It looks like the problem is that you added the rules to NAT the traffic, but not to actually allow it to pass. The following rule is a quick way to allow all traffic that you're NATting:

iptables -A INPUT -m conntrack --ctstate DNAT -j ACCEPT

See if this rule does what you want. If it still doesn't work, try changing the INPUT chain policy back to ACCEPT temporarily, just to figure out whether the firewall is the problem or not.

  • Regretfully, this does not work. Changing the INPUT chain policy back to ACCEPT also doesn't enable it to work. Feb 27, 2017 at 14:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .