# Port Forwarding with iptables (SOLVED)

## ShadowEyez

Hi all, using iptables v1.3.5 on gentoo, with nat/masq from eth0 local to ppp0 outside

I've read the netfilter examples and googled, but can not figure this out:  I want to be able to accept all incoming (from ppp0) connections that are on port 10000 and have them forwarded to the LAN (eth0).  I have tried:

iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 10000 -j DNAT

iptables -A FORWARD -i ppp0 -o eth0 -p tcp --dport 10000 -j ACCEPT

but after I type the first one the shell responds: iptables v1.3.5: You must specify --to-destination

which the iptables man page says needs an ip address, when I use

iptables -t nat -A PREROUTING -i ppp0 -p tcp --to-destination 192.168.0.254 --dport 10000 -j DNAT

the shell says: iptables v1.3.5: Unknown arg `--to-destination'

How do I allow port 10000 in with iptables?

TIA,

DavidLast edited by ShadowEyez on Sun Jan 07, 2007 9:25 pm; edited 1 time in total

----------

## moocha

 *ShadowEyez wrote:*   

> Hi all, using iptables v1.3.5 on gentoo, with nat/masq from eth0 local to ppp0 outside
> 
> I've read the netfilter examples and googled, but can not figure this out:  I want to be able to accept all incoming (from ppp0) connections that are on port 10000 and have them forwarded to the LAN (eth0).  I have tried:
> 
> iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 10000 -j DNAT
> ...

 I assume you want to DNAT all incoming TCP packets from ppp0 with destination port 10000 to 192.168.0.254 on the same port? It wasn't clear from what you posted, but it's the most likely scenario. If yes, then the reason iptables complains is that --to-destination must follow -j DNAT, and the proper syntax would be

```
iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 10000 -j DNAT --to-destination 192.168.0.254
```

If you want them DNATed to a different port on 192.168.0.254, say for example port 12345, change the last part to

```
--to-destination 192.168.0.254:12345
```

----------

## rmh3093

 *ShadowEyez wrote:*   

> Hi all, using iptables v1.3.5 on gentoo, with nat/masq from eth0 local to ppp0 outside
> 
> I've read the netfilter examples and googled, but can not figure this out:  I want to be able to accept all incoming (from ppp0) connections that are on port 10000 and have them forwarded to the LAN (eth0).  I have tried:
> 
> iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 10000 -j DNAT
> ...

 

I found trying to configure iptables from the cmdline to be a pain in the ass so I just 'emerge webmin' and configure with the web gui... that works really well and you sholdnt have any issues configure it

----------

## ShadowEyez

Thanks #2, it appears I was forgetting what order the --to-destination option needed to be.  That got it working, now to tweak the start up scripts...

----------

