Forward (redirect/nat) traffic with iptables
If you want to redirect/nat some traffic IP 1.1.1.1 to IP 2.2.2.2, it simply can be done with iptables.
You can also redirect/nat traffic to specific port by specifying a port instead of range.
It's useful for example if you would like to configure "double openvpn": in this case you connect to 1st ip address which forward you to your open vpn server and you "exit under second ip".
First of all enable IP forwarding in /etc/sysctl.conf on 1.1.1.1 host:
net.ipv4.ip_forward=1
Execute following for the changes to take effect:
sysctl -p
iptables rules example to forward&nat with another ip all tcp/udp traffic with port ranges 1000-65500
iptables -A FORWARD -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 1000:65500 -j ACCEPT #forward tcp port range iptables -A FORWARD -d 2.2.2.2 -i eth0 -p udp -m udp --dport 1000:65500 -j ACCEPT #forward udp port range iptables -t nat -A PREROUTING -d 1.1.1.1 -p tcp -m tcp --dport 1000:65500 -j DNAT --to-destination 2.2.2.2 #tcp port range iptables -t nat -A PREROUTING -d 1.1.1.1 -p udp -m udp --dport 1000:65500 -j DNAT --to-destination 2.2.2.2 #udp port range iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Example for single tcp port:
iptables -A FORWARD -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 3389 -j ACCEPT iptables -t nat -A PREROUTING -d 1.1.1.1 -p tcp -m tcp --dport 3389 -j iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
Save and restart
iptables-save >/etc/sysconfig/iptables service iptables restart
Here is an example of working iptables:
# Generated by iptables-save v1.4.7 on Tue Apr 9 14:27:04 2013 *filter :FORWARD ACCEPT [0:0] -A FORWARD -d 2.2.2.2 -i eth0 -p tcp -m tcp --dport 23:65500 -j ACCEPT -A FORWARD -d 2.2.2.2 -i eth0 -p udp -m udp --dport 23:65500 -j ACCEPT COMMIT # Completed on Tue Apr 9 14:27:04 2013 # Generated by iptables-save v1.4.7 on Tue Apr 9 14:27:04 2013 *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A PREROUTING -d 1.1.1.1 -p tcp -m tcp --dport 23:65500 -j DNAT --to-destination 2.2.2.2 -A PREROUTING -d 1.1.1.1 -p udp -m udp --dport 23:65500 -j DNAT --to-destination 2.2.2.2 -A POSTROUTING -o eth0 -j MASQUERADE COMMIT # Completed on Tue Apr 9 14:27:04 2013
Warning: Make sure your ssh port is out of range 23:65500, otherwise you will lose ssh access to 1.1.1.1. ""