iptables Tables and Chains

Oct 13, 2025 by wbrum.org 90 views

Introduction

As a seasoned system administrator, you're likely familiar with the complexities of network configuration and security. In this article, we'll delve into the world of iptables, a powerful firewalling tool for Linux systems. Specifically, we'll explore how to forward external IP and port to internal IP and port using iptables. This is a crucial aspect of network configuration, especially when dealing with web servers, databases, or other services that require external access.

Understanding iptables

Before we dive into the examples, let's quickly review the basics of iptables. iptables is a user-space application programming interface (API) used to set up and maintain tables of IP packet filtering rules in the Linux kernel. It's a powerful tool for managing network traffic, including filtering, forwarding, and mangling packets.

iptables Tables and Chains

iptables uses a table-based system to manage network traffic. The main tables are:

filter: This table is used for packet filtering, which determines whether packets are allowed to pass through the firewall.
nat: This table is used for network address translation (NAT), which allows you to translate one IP address to another.
mangle: This table is used for packet mangling, which allows you to modify packet headers.

Each table has multiple chains, which are used to manage packet flow. The main chains are:

INPUT: This chain is used to manage incoming packets.
OUTPUT: This chain is used to manage outgoing packets.
FORWARD: This chain is used to manage packets that are being forwarded between interfaces.

Forwarding External IP and Port to Internal IP and Port

Now that we've covered the basics of iptables, let's move on to the main topic of this article: forwarding external IP and port to internal IP and port. This is a common requirement in web development, where you need to expose a web server or other service to the outside world while keeping it secure.

Here's an example of how to forward external IP and port to internal IP and port using iptables:

Example 1: Forwarding HTTP Traffic

Suppose you have a web server running on internal IP address 192.168.1.100 and port 80. You want to forward incoming HTTP traffic from external IP address 203.0.113.100 and port 80 to the internal web server.

iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to-source 203.0.113.100

In this example, we're using the PREROUTING chain in the nat table to redirect incoming HTTP traffic from external IP address 203.0.113.100 and port 80 to the internal web server at 192.168.1.100 and port 80. We're also using the POSTROUTING chain to SNAT (Source NAT) the internal IP address to the external IP address.

Example 2: Forwarding HTTPS Traffic

Suppose you have a web server running on internal IP address 192.168.1.100 and port 443. You want to forward incoming HTTPS traffic from external IP address 203.0.113.100 and port 443 to the internal web server.

iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.100:443
iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to-source 203.0.113.100

In this example, we're using the PREROUTING chain in the nat table to redirect incoming HTTPS traffic from external IP address 203.0.113.100 and port 443 to the internal web server at 192.168.1.100 and port 443. We're also using the POSTROUTING chain to SNAT the internal IP address to the external IP address.

Example 3: Forwarding Multiple Ports

Suppose you have a web server running on internal IP address 192.168.1.100 and multiple ports (e.g., 80, 443, 8080). You want to forward incoming traffic from external IP address 203.0.113.100 and multiple ports to the internal web server.

iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.100:443
iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.100:8080
iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to-source 203.0.113.100

In this example, we're using the PREROUTING chain in the nat table to redirect incoming traffic from external IP address 203.0.113.100 and multiple ports to the internal web server at 192.168.1.100 and multiple ports. We're also using the POSTROUTING chain to SNAT the internal IP address to the external IP address.

Conclusion

In this article, we've explored how to forward external IP and port to internal IP and port using iptables. We've covered three examples: forwarding HTTP traffic, forwarding HTTPS traffic, and forwarding multiple ports. By following these examples, you should be able to set up iptables rules to forward external IP and port to internal IP and port, making it easier to expose your web server or other services to the outside world while keeping them secure.

Additional Tips and Considerations

When working with iptables, it's essential to consider the following tips and considerations:

Use the correct chain: Make sure to use the correct chain (e.g., PREROUTING, POSTROUTING) and table (e.g., nat, filter) for your iptables rule.
Use the correct protocol: Make sure to use the correct protocol (e.g., tcp, udp) for your iptables rule.
Use the correct port: Make sure to use the correct port (e.g., 80, 443) for your iptables rule.
Use the correct IP address: Make sure to use the correct IP address (e.g., 192.168.1.100, 203.0.113.100) for your iptables rule.
Test your rules: Make sure to test your iptables rules to ensure they're working as expected.
Use a firewall management tool: Consider using a firewall management tool (e.g., firewalld) to simplify iptables rule management.

Introduction

In our previous article, we explored how to forward external IP and port to internal IP and port using iptables. In this article, we'll answer some frequently asked questions (FAQs) about iptables and forwarding external IP and port to internal IP and port.

Q: What is the difference between DNAT and SNAT?

A: DNAT (Destination NAT) is used to redirect incoming traffic from an external IP address to an internal IP address. SNAT (Source NAT) is used to translate an internal IP address to an external IP address.

Q: How do I forward multiple ports using iptables?

A: To forward multiple ports using iptables, you can use the -p option to specify the protocol (e.g., tcp, udp) and the --dport option to specify the destination port. For example:

iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80
iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 443 -j DNAT --to-destination 192.168.1.100:443
iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 8080 -j DNAT --to-destination 192.168.1.100:8080

Q: How do I forward traffic from a specific IP address to a specific port using iptables?

A: To forward traffic from a specific IP address to a specific port using iptables, you can use the -d option to specify the destination IP address and the --dport option to specify the destination port. For example:

iptables -t nat -A PREROUTING -d 203.0.113.100 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.100:80

Q: How do I forward traffic from a specific port to a specific IP address using iptables?

A: To forward traffic from a specific port to a specific IP address using iptables, you can use the -p option to specify the protocol (e.g., tcp, udp) and the --dport option to specify the destination port. For example:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 203.0.113.100:80

Q: How do I forward traffic from a specific IP address to a specific port using SNAT?

A: To forward traffic from a specific IP address to a specific port using SNAT, you can use the -s option to specify the source IP address and the --dport option to specify the destination port. For example:

iptables -t nat -A POSTROUTING -s 192.168.1.100 -j SNAT --to-source 203.0.113.100:80

Q: How do I forward traffic from a specific port to a specific IP address using SNAT?

A: To forward traffic from a specific port to a specific IP address using SNAT, you can use the -p option to specify the protocol (e.g., tcp, udp) and the --dport option to specify the destination port. For example:

iptables -t nat -A POSTROUTING -p tcp --dport 80 -j SNAT --to-source 203.0.113.100:80

Q: How do I save and load iptables rules?

A: To save and load iptables rules, you can use the iptables-save and iptables-restore commands. For example:

iptables-save > /etc/iptables.rules
iptables-restore < /etc/iptables.rules

Q: How do I reset iptables rules?

A: To reset iptables rules, you can use the iptables -F command. For example:

iptables -F

Conclusion

In this article, we've answered some frequently asked questions (FAQs) about iptables and forwarding external IP and port to internal IP and port. We've covered topics such as DNAT and SNAT, forwarding multiple ports, and saving and loading iptables rules. By following these examples and tips, you should be able to set up iptables rules to forward external IP and port to internal IP and port, making it easier to expose your web server or other services to the outside world while keeping them secure.