I have nat and packet routing working just fine, but I'd like to forward all ports except SSH to a static ip(

What would be the correct iptables syntax to do this?


Since the iptables rules are executed in order (the first match applies, the following rules are not even tested), you can do it as follows:

 iptables -t nat -A PREROUTING -i eth0 -d -j DNAT --to
 iptables -t nat -A PREROUTING -i eth0 -d -j DNAT --to
 iptables -A FORWARD -i eth0 -d --dport 22 -j REJECT
 iptables -A FORWARD  -i eth0 -d -j ACCEPT
 iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

having assumed that the pc on which you are doing this has IP address, otherwise change it accordingly. THe last rule is needed to assure connectivity of the pc with IP address

  • is eth0 the WAN or LAN interface?
    – Avery3R
    Feb 10 '14 at 18:22
  • @MMavipc I assumed eth0 to be the WAN interface Feb 10 '14 at 18:50
  • Just for clarification, this will only forward the ports to right? I have NATed
    – Avery3R
    Feb 10 '14 at 19:05
  • @MMavipc Right. If you have already natted, then you probably do not need the last iptables rule. Feb 10 '14 at 19:06
  • 2
    The first two commands appear to be identical; what am I missing?  Also, since the third command uses --dport, doesn't it need to say -p tcp (or -p udp)? Sep 15 '15 at 4:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.