Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
To forward a port through a Linux gateway, enable IPv4 forwarding, add a destination-NAT (DNAT) rule in nat/PREROUTING, allow the translated flow in the filter table’s FORWARD chain, and ensure replies return through the gateway. Add narrowly scoped source NAT (SNAT or MASQUERADE) only when the internal server’s routing would otherwise send replies somewhere else.
How iptables port forwarding works
A forwarded connection crosses several kernel decisions. Understanding the order prevents the common mistake of creating DNAT and then wondering why the connection still times out.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Stage | What happens | Rule location |
|---|---|---|
| 1. Arrival | The packet enters the gateway on the WAN interface. | Interface and protocol matches can be applied in PREROUTING. |
| 2. Destination translation | DNAT changes the public destination address and, when specified, the destination port to the internal server. | nat table, PREROUTING chain. |
| 3. Routing | The kernel chooses the LAN route using the translated destination. | Kernel routing decision. |
| 4. Filtering | The packet is checked against the gateway’s forwarding policy. | filter table, FORWARD chain. |
| 5. Delivery | The packet leaves through the LAN interface and reaches the server. | Output interface and server route. |
| 6. Return | Conntrack reverses the NAT for replies, but only if replies come back through this gateway. | Conntrack and optional POSTROUTING SNAT/MASQUERADE. |
The filter table evaluates the translated destination. Therefore, after forwarding public TCP port 8443 to 192.168.1.20:443, the FORWARD rule must allow destination 192.168.1.20 and port 443, not the public port 8443.
Prerequisites and values to identify first
- Root or
sudoaccess on the gateway. - A WAN-facing interface, such as
eth0orens3, and a LAN-facing interface, such aseth1orens4. - The internal server’s fixed address, for example
192.168.1.20, and the service’s listening port. - A service that is actually listening on the internal address and reachable from the gateway or another LAN host.
- An IPv4 route on the server that sends replies to the Linux gateway, unless you deliberately configure narrowly scoped SNAT.
Confirm interface names and addresses before writing rules:
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
ip -br address
ip routeCheck which iptables backend is active:
iptables -VOutput containing nf_tables indicates the iptables-nft compatibility frontend; output containing legacy indicates the older backend. Do not assume that rules inspected through one frontend are present in the other. Record the backend because persistence and rule-management tools must restore the same rule set.
Configure a TCP port forward step by step
The following example publishes TCP port 8443 on WAN_IF, sends it to HTTPS on 192.168.1.20:443, and permits only that connection in both directions. Replace every uppercase placeholder with a real value.
1. Enable IPv4 forwarding
Enable forwarding immediately:
sudo sysctl -w net.ipv4.ip_forward=1Verify the running value:
sysctl net.ipv4.ip_forwardThe expected output ends with = 1. This change is normally runtime-only. Make it persistent using your distribution’s sysctl configuration, commonly by placing the setting in a file under /etc/sysctl.d/ and loading it with sysctl --system:
echo 'net.ipv4.ip_forward = 1' | sudo tee /etc/sysctl.d/99-ip-forward.conf
sudo sysctl --systemUse the filename convention supplied by your distribution if it manages that directory differently.
2. Add DNAT in nat/PREROUTING
sudo iptables -t nat -A PREROUTING -i WAN_IF -p tcp --dport 8443
-j DNAT --to-destination 192.168.1.20:443The ingress-interface match prevents an identical packet arriving from an unexpected interface from being translated. The protocol and port match make this rule specific to TCP 8443. DNAT changes the destination before the routing and forwarding checks.
3. Permit the new connection in FORWARD
sudo iptables -A FORWARD -i WAN_IF -o LAN_IF -p tcp
-d 192.168.1.20 --dport 443
-m conntrack --ctstate NEW,ESTABLISHED -j ACCEPTThis rule deliberately names the translated address and port. A rule allowing only the public address or public port will not match after DNAT.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
4. Permit replies
sudo iptables -A FORWARD -i LAN_IF -o WAN_IF -p tcp
-s 192.168.1.20 --sport 443
-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTThe state match allows packets belonging to a connection already admitted by the first rule, plus related traffic tracked by conntrack. If your existing firewall uses a different state policy, place these rules consistently with that policy and with any final deny rule.
5. Test from outside the LAN
Use a client on the Internet or another network, not a LAN client using the gateway’s public address. Test the public endpoint:
curl -vk https://PUBLIC_IP:8443/For a non-HTTP service, use an appropriate client or a TCP probe. A successful TCP handshake proves reachability to the listener; it does not prove that the application protocol is configured correctly.
Forwarding ports 80, 443, 22, and UDP services
The mechanism is identical for other ports. Keep the public and internal ports explicit when they differ.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Use case | DNAT example | Translated destination to allow in FORWARD |
|---|---|---|
| Public HTTP 80 to internal HTTP 80 | -p tcp --dport 80 -j DNAT --to-destination 192.168.1.20:80 |
192.168.1.20 --dport 80 |
| Public HTTPS 443 to internal HTTPS 443 | -p tcp --dport 443 -j DNAT --to-destination 192.168.1.20:443 |
192.168.1.20 --dport 443 |
| Public TCP 2222 to SSH 22 | -p tcp --dport 2222 -j DNAT --to-destination 192.168.1.20:22 |
192.168.1.20 --dport 22 |
| Public UDP 51820 to an internal UDP service | -p udp --dport 51820 -j DNAT --to-destination 192.168.1.20:51820 |
192.168.1.20 --dport 51820 |
For UDP, change both the DNAT and forwarding rules to -p udp, and use state rules appropriate to the connectionless traffic. Conntrack can still track UDP flows, but the application may need additional related-port allowances.
When SNAT or MASQUERADE is required
DNAT changes the inbound destination. It does not automatically fix an asymmetric return path. The internal server must send its reply to the Linux gateway so conntrack can reverse the translation and deliver the reply to the original client.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Preferred fix: correct the server route
If the server is on the gateway’s LAN, set its default gateway to the Linux gateway or add a route for the relevant client networks through that gateway. This preserves the original client address in server logs and avoids unnecessary source translation.
Fallback: narrowly scope source NAT
If changing the server’s routing is impossible, apply SNAT or MASQUERADE only to the forwarded traffic. MASQUERADE uses the address of the outgoing interface and is useful when that address changes; SNAT is preferable when the gateway has a stable address. A generic MASQUERADE pattern is:
Recommended Free Tools
sudo iptables -t nat -A POSTROUTING -o LAN_IF
-s CLIENT_NET -d 192.168.1.20 -p tcp --dport 443
-j MASQUERADEReplace CLIENT_NET with the smallest source range that needs this workaround. Do not add an unrestricted masquerade rule merely because a DNAT connection failed; broad source NAT hides client identities and can create unintended forwarding behavior. Source NAT belongs in POSTROUTING, while destination NAT belongs in PREROUTING.
Hairpin NAT for clients inside the LAN
A LAN client connecting to the gateway’s public address follows a different path from an Internet client. Depending on routing and firewall policy, the packet may not match the WAN DNAT rule, or the internal server may reply directly to the LAN client without passing through conntrack. Test this path separately.
If internal clients must use the public name and address, create a LAN-specific DNAT rule and, when necessary, a matching source-NAT rule:
sudo iptables -t nat -A PREROUTING -i LAN_IF -s LAN_NET -d PUBLIC_IP
-p tcp --dport 8443 -j DNAT --to-destination 192.168.1.20:443
sudo iptables -A FORWARD -i LAN_IF -o LAN_IF -p tcp
-d 192.168.1.20 --dport 443
-m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -t nat -A POSTROUTING -o LAN_IF -s LAN_NET
-d 192.168.1.20 -p tcp --dport 443 -j MASQUERADEUse the narrowest LAN source range and verify that your interface, routing, and existing policies permit same-interface forwarding. If split DNS is available, resolving the internal hostname directly to the internal address is often simpler than hairpin NAT.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Verify each stage instead of guessing
Check the listener first
On the internal host, verify that the service listens on the expected address and port, not only on loopback:
sudo ss -lntupFrom the gateway or a LAN machine, connect directly to the internal address and port. If that fails, port forwarding is not the cause; fix the service, host firewall, or LAN routing first.
Check forwarding and rule counters
sysctl net.ipv4.ip_forward
sudo iptables -t nat -L PREROUTING -n -v
sudo iptables -L FORWARD -n -vGenerate one test connection, then inspect packet and byte counters. A DNAT counter that remains at zero indicates an interface, address, protocol, or port mismatch. A DNAT counter that increases while the corresponding FORWARD counter does not usually means the filter rule does not match the translated destination or another rule handles the packet first.
Capture both sides of the gateway
sudo tcpdump -ni WAN_IF 'tcp port 8443'
sudo tcpdump -ni LAN_IF 'host 192.168.1.20 and tcp port 443'Interpret the results in order:
- No WAN packet: the client is using the wrong public address, DNS result, or upstream firewall.
- WAN packet but no LAN packet: DNAT, routing, forwarding policy, or an earlier rule is stopping it.
- LAN packet leaves but no reply appears: the service, host firewall, or server route is wrong.
- Reply appears on LAN but not WAN: the return path, conntrack state, reverse-path filtering, or postrouting policy needs investigation.
Inspect routes and reverse-path filtering
ip route get 192.168.1.20
ip route get CLIENT_IP
sysctl net.ipv4.conf.all.rp_filter
sysctl net.ipv4.conf.default.rp_filterReverse-path filtering can reject packets when the kernel’s expected return interface differs from the ingress interface. Correct the routing design first; change reverse-path filtering only after understanding the security implications and the distribution’s defaults.
Make rules persistent and recoverable
Commands entered with iptables normally live only until reboot or firewall reload. Save a known-good ruleset after testing:
sudo iptables-save | sudo tee /root/iptables-working.v4 > /dev/nullUse the persistence mechanism supported by your distribution and backend. On systems that provide an iptables persistence service, its configuration commonly restores an IPv4 rules file such as /etc/iptables/rules.v4 at boot:
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
sudo iptables-save | sudo tee /etc/iptables/rules.v4 > /dev/null
sudo systemctl enable --now netfilter-persistentThe service name and file location are not universal; confirm them in your distribution’s firewall documentation. If the host uses a native nftables service, persist the nftables ruleset instead of maintaining a separate compatibility-layer file. Keep a dated backup before changes and document whether the host uses iptables-nft or legacy, because restoring through the wrong backend can leave the active firewall unchanged.
After rebooting or reloading the firewall, verify forwarding, counters, and an external connection again. A saved file is not evidence that the running kernel accepted the rules.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSecurity and maintenance checklist
- Bind DNAT to the expected ingress interface.
- Match the exact protocol, public port, internal address, and internal port.
- Allow the translated destination in
FORWARD; do not rely on an unrestricted any-to-any rule. - Use conntrack state matches for new and established traffic.
- Restrict source addresses for administration services such as SSH whenever a known management range exists.
- Keep the internal server patched and protected by its own host firewall; a gateway rule exposes the service but does not harden it.
- Review counters and logs periodically, and remove obsolete forwards.
- Back up rules before editing and test rollback from a local console or out-of-band session.
- Apply equivalent IPv6 policy deliberately. An IPv4 iptables rule does not forward IPv6 traffic.
iptables-nft, legacy, and IPv6 considerations
Modern distributions may provide the iptables command as a compatibility interface to nftables, while older installations use the legacy xtables backend. The command syntax can look identical while the underlying ruleset and persistence service differ. Check iptables -V, use one management method consistently, and inspect the active rules with the corresponding tool.
For IPv6, use an IPv6-aware ruleset and verify that the distribution’s firewall design supports the required translation model. Do not copy IPv4 addresses, sysctl assumptions, or persistence files into an IPv6 configuration without adapting them. Test IPv4 and IPv6 separately because a service may be reachable over one protocol and blocked over the other.
Common failure patterns
“DNAT works, but the service times out”
Confirm that net.ipv4.ip_forward is 1, that the FORWARD rule names the translated internal address and port, and that the server listens on that address. Then capture traffic on the LAN interface and verify the server’s default route.
“The FORWARD rule never matches”
DNAT occurs before filtering, so inspect the post-translation destination. Check rule order, interface names, protocol, and port. A broad earlier rule may accept or reject the packet before the intended rule is reached.
“The server receives packets but clients never get replies”
Inspect the server’s route and the LAN capture. Make the Linux gateway the return path, or add narrowly scoped SNAT/MASQUERADE. Also check reverse-path filtering and conntrack state.
“It works from the Internet but not from inside”
This is usually a hairpin-NAT or DNS-path issue, not a failure of the external forward. Add the LAN-specific translation only if internal clients must use the public address; otherwise use split DNS and test each path independently.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
