2

I have nat and packet routing working just fine, but I'd like to forward all ports except SSH to a static ip(192.168.0.3)

What would be the correct iptables syntax to do this?

3

Since the iptables rules are executed in order (the first match applies, the following rules are not even tested), you can do it as follows:

 iptables -t nat -A PREROUTING -i eth0 -d 192.168.0.2 -j DNAT --to 192.168.0.3
 iptables -t nat -A PREROUTING -i eth0 -d 192.168.0.2 -j DNAT --to 192.168.0.3
 iptables -A FORWARD -i eth0 -d 192.168.0.2 --dport 22 -j REJECT
 iptables -A FORWARD  -i eth0 -d 192.168.0.2 -j ACCEPT
 iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

having assumed that the pc on which you are doing this has IP address 192.168.0.2, otherwise change it accordingly. THe last rule is needed to assure connectivity of the pc with IP address 192.168.0.3.

  • is eth0 the WAN or LAN interface? – Avery3R Feb 10 '14 at 18:22
  • @MMavipc I assumed eth0 to be the WAN interface – MariusMatutiae Feb 10 '14 at 18:50
  • Just for clarification, this will only forward the ports to 192.168.0.3 right? I have 192.168.0.0/16 NATed – Avery3R Feb 10 '14 at 19:05
  • @MMavipc Right. If you have already natted 192.168.0.0/16, then you probably do not need the last iptables rule. – MariusMatutiae Feb 10 '14 at 19:06
  • 2
    The first two commands appear to be identical; what am I missing?  Also, since the third command uses --dport, doesn't it need to say -p tcp (or -p udp)? – G-Man Says 'Reinstate Monica' Sep 15 '15 at 4:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.