I have nat and packet routing working just fine, but I'd like to forward all ports except SSH to a static ip(192.168.0.3)
What would be the correct iptables syntax to do this?
Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.Sign up to join this community
Since the iptables rules are executed in order (the first match applies, the following rules are not even tested), you can do it as follows:
iptables -t nat -A PREROUTING -i eth0 -d 192.168.0.2 -j DNAT --to 192.168.0.3 iptables -t nat -A PREROUTING -i eth0 -d 192.168.0.2 -j DNAT --to 192.168.0.3 iptables -A FORWARD -i eth0 -d 192.168.0.2 --dport 22 -j REJECT iptables -A FORWARD -i eth0 -d 192.168.0.2 -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
having assumed that the pc on which you are doing this has IP address 192.168.0.2, otherwise change it accordingly. THe last rule is needed to assure connectivity of the pc with IP address 192.168.0.3.