Port-Forward using IPTables

First of all, we need to check if port forwarding is enabled or not on our server. For better understanding, we will be using ens18 as a reference interface and all our command executions will be related to ens18 in this article.

How to check if port forwarding is enabled in Linux
Either we can use sysctl to check if forwarding is enabled or not. Use below command to check:

[[email protected] ~]# sysctl -a |grep -i ens18.forwarding
net.ipv4.conf.ens18.forwarding = 0
net.ipv6.conf.ens18.forwarding = 0


Since both values are zero, port forwarding is disabled for ipv4 and ipv6 on interface ens18.

We can also use the process filesystem to check if port forwarding is enabled or not.

[[email protected] ~]# cat /proc/sys/net/ipv4/conf/ens18/forwarding
0
[[email protected] ~]# cat /proc/sys/net/ipv6/conf/ens18/forwarding
0


Again here process FS with zero values confirms port forwarding is disabled on our system. Now we need to first enable port forwarding on our system then we will configure port forwarding rules in iptables.

How to enable port forwarding in Linux

As we checked above, using the same methods we can enable port forwarding in Linux. But its recommended using sysctl command rather than replacing 0 by 1 in proc files.

Enable port forwarding in Linux using sysctl command:

[[email protected] ~]# sysctl net.ipv4.conf.ens18.forwarding=1
net.ipv4.conf.ens18.forwarding = 1

[[email protected] ~]# sysctl net.ipv6.conf.ens18.forwarding=1
net.ipv6.conf.ens18.forwarding = 1

To make it persistent over reboots, add parameters in /etc/sysctl.conf :

[[email protected] ~]# echo "net.ipv4.conf.ens18.forwarding = 1">>/etc/sysctl.conf

[[email protected] ~]# echo "net.ipv6.conf.ens18.forwarding = 1">>/etc/sysctl.conf

[[email protected] ~]# sysctl -p
net.ipv4.conf.ens18.forwarding = 1
net.ipv6.conf.ens18.forwarding = 1

Now, we have port forwarding enabled on our server, we can go ahead with configuring port forwarding rules using iptables.

How to forward port in Linux

Here we will forward port 80 to port 8080 on 192.168.1.1. Do not get confused port forwarding with port redirection.

We need to insert an entry in PREROUTING chain of iptables with DNAT target. Command will be as follows:

iptables -A PREROUTING -t nat -i ens18 -p tcp --dport 80 -j DNAT --to 192.168.1.1:8080
iptables -A FORWARD -p tcp -d 192.168.1.1 --dport 8080 -j ACCEPT

Change interface, IP and ports as per our requirement. The first command tells us to redirect packets coming to port 80 to IP 192.168.1.1 on port 8080. Now packet also needs to go through FORWARD chain so we are allowing in in the second command.

Now rules have been applied. We need to verify them.

How to check port forwarding IPTables rules

Command to verify port forwarding rules is:

[[email protected] ~]# iptables -t nat -L -n -v
Chain PREROUTING (policy ACCEPT 1 packets, 30 bytes)
  pkts bytes target     prot opt in     out     source               destination
    84  5000 REDIRECT   tcp  --  ens18  *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 to:192.168.1.1:8080

Here REDIRECT target means it’s a redirection rule. Since we have configured the forwarding rule we see the target as DNAT

How to save iptables rules

To save iptables rules and make them persistent over reboots use the following command:

[[email protected] ~]# iptables-save