Iptables commands to apply some rules.

In the iptables rules -i is in-interfaces means the interface from with the traffic coming in and -o is for the out-interfaces the interface from where traffic going out.

Forward coming traffic to a machine in network
We want to forward web server traffic coming to our machine to port 80 of ip address 192.168.0.3 in the network.
First enable the ip4 forward read the article Configure network
Now apply these iptables rules:
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 80 -j DNAT --to 192.168.0.3:80
iptables -A FORWARD -p tcp -i ppp0 -d 192.168.1.3 --dport 80 -j ACCEPT
Open a port for forwarding:
iptables -A FORWARD -i all -p udp -m udp --dport 4665 -j ACCEPT
Open a port to accept connections:
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5801 -j ACCEPT
Close or block a port to refuse the connections:
iptables -A INPUT -p tcp --dport 25 -j DROP
To redirect the traffic from one port to another in the same machine:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
Will redirect the http traffic from port 80 to port 8080 in the same machine.
Redirect the traffic to another machine
It's in 3 easy steps, first enable the ip forward for kernel. Second step is to create iptables to redirect rules the all traffic coming to the port 80 of this machine to the other machine with the ip address 122.164.34.240:
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 122.164.34.240
The last step is to enable the IP Masquerade, the IP Masquerade feature allows other "internal" computers connected to this Linux box (via PPP, Ethernet, etc.) to also reach the Internet as well. Linux IP Masquerading allows for this functionality even though these internal machines don't have an officially assigned IP address.
MASQ allows a set of machines to invisibly access the Internet via the MASQ gateway. To other machines on the Internet, the outgoing traffic will appear to be from the IP MASQ Linux server itself :
iptables -t nat -A POSTROUTING -p tcp -d 122.164.34.240 --dport 8080 -j MASQUERADE


<< Previous Next >>