iptables Port Forwarding for Linux

Port forwarding redirects network traffic from external ports to internal services. This allows applications running behind firewalls to receive incoming connections from external networks.

Important Note: Most modern Linux distributions now use nftables as the default firewall framework. While iptables remains fully supported and widely used in production environments, nftables offers improved syntax and performance. This guide focuses on iptables for legacy system administration and environments where nftables are not available.

iptables vs nftables quick comparison

Quick start

Forward port 80 to internal server 192.168.1.10:8080:

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:8080
iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 8080 -j ACCEPT
iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
netfilter-persistent save

Replace ens33 with your network interface name. See the full guide below.

Prerequisites

Requirements:

• Root or sudo access to your Linux server
• Properly configured network interfaces (verify: ip addr show)
• Basic networking knowledge (IP addresses, ports, protocols)
• iptables installed (verify: iptables --version)

All iptables commands require root privileges to modify firewall rules.

How iptables works

iptables configures Linux packet filtering through tables and chains. Each table serves a specific purpose, with chains processing packets sequentially.

Basic command syntax:

iptables -t [table] -A [chain] [match_criteria] -j [target]

The nat table handles Network Address Translation operations. For port forwarding, we use three chains in the nat table.

The PREROUTING chain processes incoming packets before routing decisions are made. When a packet arrives, PREROUTING rules execute first, allowing you to change the destination address before the kernel routes the packet.

The POSTROUTING chain handles packets after routing decisions, just before they leave the system. POSTROUTING ensures response packets can find their way back to the original sender.

The FORWARD chain in the filter table controls which packets can traverse your system. Every packet passing through your system must be explicitly allowed in the FORWARD chain, unless you set a permissive default policy.

The default FORWARD policy is typically DROP for security. Check your policy with:

iptables -L FORWARD -v -n | grep policy

Installing iptables

On Debian-based systems, install iptables with the following command:

apt update && apt install iptables

Verify the installation by viewing current rules:

iptables -L -v -n

Check your network interface names as you will need them later:

ip link show

Modern systems typically use interface names like ens33, ens5, or eth0.

Enabling IP forwarding

Enable IP forwarding (disabled by default):

Check the current forwarding status:

sysctl net.ipv4.ip_forward

A value of 0 means disabled. A value of 1 means enabled.

Enable forwarding temporarily for immediate testing:

sysctl -w net.ipv4.ip_forward=1

To make forwarding permanent across reboots, edit the sysctl configuration file:

nano /etc/sysctl.conf

Add or modify this line:

net.ipv4.ip_forward = 1

Apply the changes immediately:

sysctl -p

Complete port forwarding configuration

Port forwarding requires three components working together: destination address translation, firewall forwarding rules, and source address masquerading. Configure each component in sequence.

Example: Forward external port 80 to internal server 192.168.1.2:8080.

Step 1: configure the PREROUTING rule

Redirect incoming traffic:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.2:8080

Step 2: add a FORWARD rule

Allow the redirected traffic through your firewall:

iptables -A FORWARD -p tcp -d 192.168.1.2 --dport 8080 -j ACCEPT

Step 3: configure MASQUERADE

Configure masquerading for proper return traffic handling.

Replace ens33 with your actual outgoing interface name:

iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE

Step 4: verify your configuration

iptables -t nat -L -v -n
iptables -L FORWARD -v -n

The packet counters should increment when traffic passes through these rules.

Common port forwarding scenarios

HTTP and HTTPS traffic

Forward standard web traffic from external ports to an internal web server:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80
iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 192.168.1.10:443
iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 80 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 443 -j ACCEPT

SSH access to internal servers

Forward SSH connections to an internal server. Consider using non-standard ports to reduce automated attacks:

iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to-destination 192.168.1.5:22
iptables -A FORWARD -p tcp -d 192.168.1.5 --dport 22 -j ACCEPT

This configuration forwards external port 2222 to the internal SSH port 22.

Warning: Maintain alternative access (console access, secondary SSH port) to prevent lockout if forwarding rules malfunction.

Saving rules permanently

iptables stores rules in memory. Without persistence, all rules disappear after a system reboot.

Install the iptables-persistent package:

apt install iptables-persistent

During installation, select yes to save current rules. This creates configuration files at /etc/iptables/rules.v4 for IPv4 and /etc/iptables/rules.v6 for IPv6.

After making changes to your rules, save them using one of these methods:

Method 1: manual save

iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6

Method 2: using netfilter-persistent (recommended)

netfilter-persistent save

Both methods achieve the same result. Method 2 is cleaner and handles both IPv4 and IPv6 simultaneously.

Create a backup before making changes:

cp /etc/iptables/rules.v4 /etc/iptables/rules.v4.backup

Troubleshooting port forwarding

Verify rules are active

List all NAT rules with packet counters:

iptables -t nat -L -v -n

Zero packet counts indicate traffic is not matching your rules. Verify IP addresses, ports, and interface names.

Check IP forwarding status

Confirm forwarding is enabled:

sysctl net.ipv4.ip_forward

If this returns 0, forwarding is disabled. Enable it using the commands in the IP forwarding section.

Enable logging for debugging

Add a LOG rule to track traffic:

iptables -t nat -I PREROUTING -p tcp --dport 80 -j LOG --log-prefix "FORWARD-80: " --log-level 4

View the logs:

tail -f /var/log/syslog

Remove logging rules after troubleshooting to prevent log flooding.

Test with tcpdump

Monitor traffic on your network interface:

tcpdump -i ens33 port 80

This shows whether packets are actually reaching your server.

Verify destination service

On the internal server, confirm the service is running:

netstat -tuln | grep 8080

Security considerations

Warning: Port forwarding exposes internal services to the internet. Forward only necessary ports because each represents a security risk.

Limit access by source IP address when possible:

iptables -t nat -A PREROUTING -s 203.0.113.0/24 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.2:8080

This restricts forwarding to traffic from the specified subnet.

Docker conflicts

Docker manages iptables rules automatically and may override custom configurations. Review Docker's rules before manual port forwarding:

iptables -t nat -L -n -v | grep DOCKER

Cloud environment considerations

When running on cloud platforms like AWS, Azure, or Google Cloud, configure both your iptables rules and cloud security groups. Cloud-level firewalls operate independently of iptables. A common mistake is configuring iptables correctly while forgetting to open ports in the cloud security group.

Rate limiting

Implement rate limiting to prevent abuse:

iptables -A FORWARD -p tcp -d 192.168.1.2 --dport 8080 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

This rule allows 25 connections per minute with a burst of 100.

Monitor forwarded traffic

Enable logging for forwarded connections:

iptables -A FORWARD -p tcp -d 192.168.1.2 --dport 8080 -j LOG --log-prefix "FWD-MONITOR: "

Review these logs regularly for unusual patterns. Set up automated alerts using tools like fail2ban.

Testing and maintenance

Test all changes on non-production systems first. When working on production systems remotely, maintain a secondary access method. Schedule regular audits to remove forwards for inactive services. Document each rule's purpose for easier maintenance.

Principle of least privilege

Grant only the minimum access necessary. If a service only needs access from specific IP ranges, do not configure it for worldwide access.

Quick reference

Copy these commands and replace bracketed values with your actual configuration.

Check current rules

iptables -t nat -L -v -n
iptables -L FORWARD -v -n

Enable IP forwarding

sysctl -w net.ipv4.ip_forward=1

Basic port forward

iptables -t nat -A PREROUTING -p tcp --dport [external_port] -j DNAT --to-destination [internal_ip]:[internal_port]
iptables -A FORWARD -p tcp -d [internal_ip] --dport [internal_port] -j ACCEPT
iptables -t nat -A POSTROUTING -o [interface] -j MASQUERADE

Save rules

iptables-save > /etc/iptables/rules.v4
netfilter-persistent save

Delete a specific rule

iptables -t nat -D PREROUTING [rule_number]

Flush all rules (use with caution)

Safety check: Confirm the target and keep a recent backup or snapshot. Preview the affected resources where possible, and document a tested recovery or rollback path before running this command.

iptables -F
iptables -t nat -F

Conclusion

Port forwarding with iptables provides precise control over network traffic routing, enabling you to expose internal services securely while maintaining proper access controls. While nftables has become the modern standard, iptables remains a reliable solution for legacy systems and backward compatibility. Always prioritize security by exposing only necessary services, implementing rate limiting, monitoring logs regularly, and conducting periodic audits of your forwarding rules. With proper planning and careful implementation, port forwarding becomes a powerful tool for managing your network infrastructure.