The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →To forward a port through a Linux gateway, enable IPv4 forwarding, add a destination-NAT (DNAT) rule in nat/PREROUTING, permit the translated connection in filter/FORWARD, and make sure replies return through the gateway. A working DNAT rule alone is not enough: filtering happens after translation, and an asymmetric return route commonly causes timeouts.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What port forwarding through a Linux gateway actually does
Assume a gateway has a public (WAN) interface and a private (LAN) interface. An Internet client connects to the gateway’s public address and port. The gateway changes the packet’s destination address and, when needed, destination port to an internal server. The internal server handles the connection as if the client had contacted it directly.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For an IPv4 TCP forward, the packet path is:
- The packet arrives on the WAN interface.
- The
nattable’sPREROUTINGchain applies DNAT before the routing decision. - The kernel routes the packet toward the LAN interface and internal address.
- The
filtertable’sFORWARDchain decides whether the translated packet is allowed. - The server sends a reply. Conntrack reverses the NAT when the reply traverses the gateway, provided the reply actually comes back through that gateway.
The filter does not see the original public destination after DNAT. It sees the internal destination and service port. The Netfilter packet-filtering HOWTO illustrates this distinction: after translation, the filter sees the “real” internal destination rather than the gateway’s public address.
| Stage | Where it happens | What you configure |
|---|---|---|
| Destination translation | nat table, PREROUTING |
Public address/port to internal address/port |
| Forwarding decision | filter table, FORWARD |
Whether the translated flow may cross interfaces |
| Return translation | Conntrack plus NAT state | Correct return route; narrowly scoped SNAT/MASQUERADE only when required |
| Source NAT, when needed | nat table, POSTROUTING |
Rewrite the source so replies come back through the gateway |
Prerequisites before writing rules
Confirm the interfaces and addresses
Replace the placeholders in every example with the real interface names and addresses. Identify the WAN interface, LAN interface, gateway’s public address, internal server address, and the service’s listening port. Commands such as ip address and ip route show the names and routes; verify them rather than assuming names such as eth0 or ens3.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
- WAN_IF: interface on which Internet traffic arrives.
- LAN_IF: interface leading to the internal network.
- 192.168.1.20: example internal server address.
- Public port: the port exposed on the gateway, such as 8443, 80, 443, or 22.
- Internal port: the port on which the server listens, which may differ from the public port.
Enable kernel forwarding
Linux will not route packets between interfaces unless IPv4 forwarding is enabled. Enable it immediately with:
sudo sysctl -w net.ipv4.ip_forward=1Check the effective value:
sysctl net.ipv4.ip_forwardThe expected output ends in = 1. The kernel documents net.ipv4.ip_forward as the Boolean control for IPv4 forwarding. The setting made with sysctl -w is runtime state; persist it using the mechanism supported by your distribution, commonly a file under /etc/sysctl.d/ followed by the distribution’s sysctl reload command. Test after a reboot because a non-persistent setting silently returns to zero.
Determine the iptables backend
Modern distributions may provide iptables commands backed by nftables (iptables-nft) or by the older xtables implementation (iptables-legacy). Both accept familiar iptables syntax, but they use different rule backends and may not show one another’s rules. Check the alternatives configuration and the output of your distribution’s version command before troubleshooting. The current iptables manual documents iptables/ip6tables 1.8.13 and records an upstream repository state dated 2026-07-10.
Use one backend consistently. A rule entered through iptables-nft will not necessarily appear in a legacy listing, and switching alternatives can make an apparently missing firewall policy look like a packet-forwarding failure.
Verify the service independently
From the gateway or another host on the LAN, test the internal address and port directly. Confirm that the service is listening on the expected address rather than only on 127.0.0.1, and check the server’s local firewall. Port forwarding cannot make a process that is stopped, bound to the loopback address, or blocked locally reachable.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Minimal TCP forward: public 8443 to 192.168.1.20:443
The following example exposes TCP port 8443 on the WAN interface and sends it to HTTPS on the internal server. It deliberately limits the match to an interface, protocol, public port, internal address, and internal port.
# Enable forwarding now
sudo sysctl -w net.ipv4.ip_forward=1
# Translate public TCP 8443 to the server's TCP 443
sudo iptables -t nat -A PREROUTING -i WAN_IF -p tcp --dport 8443
-j DNAT --to-destination 192.168.1.20:443
# Allow the new and established inbound flow after DNAT
sudo iptables -A FORWARD -i WAN_IF -o LAN_IF -p tcp
-d 192.168.1.20 --dport 443
-m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
# Allow replies from that server back to the WAN
sudo iptables -A FORWARD -i LAN_IF -o WAN_IF -p tcp
-s 192.168.1.20 --sport 443
-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTDNAT belongs in nat/PREROUTING; the DNAT target’s --to-destination value can include an address and port. The first FORWARD rule uses the translated destination (192.168.1.20:443), not the public port 8443. The second rule permits only return traffic associated with an existing connection.
What to adjust for an existing firewall policy
The commands above append rules. If your policy has a default DROP rule, place the accepts before any terminating DROP rule. If your policy already has an established/related rule near the top of FORWARD, you may need only the narrowly scoped NEW rule for the forward, but inspect counters and ordering rather than assuming. Do not replace a carefully managed policy with a broad -i WAN_IF -o LAN_IF -j ACCEPT rule.
Forwarding ports 80, 443, and 22
Use the same three-part design for common services. Keep the public and internal ports explicit so an accidental port change is visible in the rule set.
| Use case | DNAT rule pattern | FORWARD match after translation |
|---|---|---|
| Public HTTP 80 to server HTTP 80 | -p tcp --dport 80 -j DNAT --to-destination 192.168.1.20:80 |
-d 192.168.1.20 --dport 80 |
| Public HTTPS 443 to server HTTPS 443 | -p tcp --dport 443 -j DNAT --to-destination 192.168.1.20:443 |
-d 192.168.1.20 --dport 443 |
| Public SSH 22 to server SSH 22 | -p tcp --dport 22 -j DNAT --to-destination 192.168.1.20:22 |
-d 192.168.1.20 --dport 22 |
| Public 8443 to internal HTTPS 443 | -p tcp --dport 8443 -j DNAT --to-destination 192.168.1.20:443 |
-d 192.168.1.20 --dport 443 |
For each row, add the corresponding interface-qualified FORWARD rule and its established/related reply rule. Exposing SSH to the entire Internet deserves additional controls such as source-address allowlists, key-only authentication, rate limiting, or a VPN; port translation by itself is not access control.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
UDP forwarding
iptables supports protocol-specific destination-port matching. For a UDP service, replace -p tcp with -p udp in DNAT and FORWARD rules and use the UDP service port. For example:
sudo iptables -t nat -A PREROUTING -i WAN_IF -p udp --dport 51820
-j DNAT --to-destination 192.168.1.30:51820
sudo iptables -A FORWARD -i WAN_IF -o LAN_IF -p udp
-d 192.168.1.30 --dport 51820
-m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i LAN_IF -o WAN_IF -p udp
-s 192.168.1.30 --sport 51820
-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPTUDP has no handshake equivalent to TCP’s connection setup, so state tracking depends on conntrack’s UDP timeouts and observed packets. If a particular application uses related auxiliary traffic, retain the RELATED match and consult that application’s port requirements rather than opening all UDP traffic.
When SNAT or MASQUERADE is necessary
DNAT changes the destination on the inbound packet. It does not automatically repair an internal server whose default route points at another router. The server’s reply must return through the Linux gateway so conntrack can reverse the translation and send the response to the original client.
Preferred solution: correct the server route
Make the Linux gateway the server’s default gateway, or add a route for the client networks through the gateway. This preserves the original client address for logging and access-control decisions and avoids unnecessary source translation.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteFallback: narrowly scoped source NAT
If changing the server’s routing is impossible, apply SNAT or MASQUERADE only to the forwarded traffic. Source NAT is normally placed in nat/POSTROUTING, after routing. MASQUERADE is useful when the gateway’s WAN address is dynamic; SNAT is more explicit when the address is stable.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
# Example: hide only forwarded TCP 8443 traffic from the server
sudo iptables -t nat -A POSTROUTING -o LAN_IF -p tcp
-d 192.168.1.20 --dport 443 -s CLIENT_NETWORK
-j MASQUERADEReplace CLIENT_NETWORK with the actual source network and tighten the match further when possible. Do not add a blanket MASQUERADE rule just because DNAT timed out: broad source NAT obscures client addresses and can create unexpected access between networks.
Hairpin NAT for clients inside the LAN
A LAN client that connects to the gateway’s public address follows a different path from an Internet client. The packet may be DNATed toward the internal server, but the server can attempt to reply directly to the LAN client instead of through the gateway. That asymmetric path breaks the expected conntrack flow.
Test hairpin access separately from an external connection. If it fails while external access works, add a dedicated LAN-to-LAN DNAT/SNAT design: match LAN clients using the public address, DNAT to the internal server, and apply narrowly scoped source NAT so the server replies to the gateway. Keep this rule separate from the WAN rule, document the source network, and verify that internal DNS can instead return the server’s private address when split-horizon DNS is practical.
Make rules persistent without losing recovery access
Rules entered with iptables -A normally live only in the running kernel. Persistence is distribution-specific, and the correct method depends on whether your system manages iptables-nft, legacy iptables, or a higher-level firewall service.
- Record the active backend and export the current rules with the distribution-supported save command, commonly
iptables-save. - Store IPv4 rules in the location used by your firewall service and configure that service to restore them at boot. Do not assume a path used by another distribution is valid on yours.
- Persist
net.ipv4.ip_forward=1separately through the system’s sysctl configuration. - Reboot or perform a controlled firewall reload during a maintenance window, then verify forwarding, counters, and remote reachability.
- Keep a console or out-of-band recovery path. A malformed FORWARD policy can cut off remote administration before you can correct it over the network.
Save a known-good ruleset before editing, and keep the DNAT, FORWARD, and any POSTROUTING rules together in change documentation. If your distribution has migrated to nftables-native configuration, use its documented persistence workflow rather than mixing hand-written nftables rules with an iptables compatibility layer.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Verification checklist
Check the host and route first
- Confirm the service is listening on the internal address and port.
- From the gateway or LAN, connect directly to the server’s private address.
- Confirm the server’s default route or a specific route sends client replies through the Linux gateway.
- Check the gateway’s WAN and LAN interface names and addresses again after network changes.
Check forwarding and rule counters
sysctl net.ipv4.ip_forward
sudo iptables -t nat -L PREROUTING -n -v
sudo iptables -L FORWARD -n -v
sudo iptables -t nat -L POSTROUTING -n -vThe forwarding value should be 1. A packet sent from an external client should increment the DNAT counter and the matching FORWARD counter. A DNAT counter that stays at zero indicates the packet is not reaching that rule, has the wrong interface, uses another protocol or port, or is hitting an earlier rule. A DNAT counter that rises while FORWARD remains unchanged points to chain order or a mismatch on the translated address and port.
Use packet capture to locate the break
Capture on both WAN and LAN interfaces while making one test connection. You want to see the original destination arrive on WAN, the translated destination leave on LAN, and a reply return from LAN. If the packet leaves but no reply appears, inspect the service, server firewall, route selection, and reverse-path filtering. If the reply appears on LAN but not WAN, inspect conntrack state, FORWARD rules, and POSTROUTING rules.
Recommended Free Tools
Testing from an Internet host matters: a LAN test to the public address exercises hairpin behavior and can fail for reasons unrelated to the WAN forward.
Common failure modes and fixes
| Symptom | Likely cause | Correction |
|---|---|---|
| Connection times out; DNAT counter is zero | Wrong WAN interface, public port, protocol, address, or rule backend | Verify packet arrival, interface names, backend selection, and rule order. |
| DNAT counter increases; FORWARD drops | No accept rule for the translated internal destination, or an earlier DROP | Allow the exact internal address/port in FORWARD before the terminating drop. |
| Gateway can reach the server; remote client cannot | Server firewall, service bind address, or missing return route | Test the service directly, inspect local filtering, and fix the server’s route. |
| Server receives a request but client never receives a reply | Asymmetric return path | Use the gateway as the server’s route or apply narrowly scoped SNAT/MASQUERADE. |
| External access works; LAN clients fail on public address | Hairpin NAT is not configured | Add a separate hairpin rule set or use internal DNS that returns the private address. |
| Rules appear to vanish or are not listed | Rules were not persisted, or commands inspect a different backend | Use the distribution’s restore mechanism and inspect the same iptables backend used to load the rules. |
| Intermittent or unexpected drops | Reverse-path filtering, route changes, or overly broad state assumptions | Check route selection and reverse-path filtering, then review conntrack states and counters. |
Security and maintenance practices
- Bind each rule to the expected ingress and egress interfaces.
- Match the protocol, public port, internal address, and internal port explicitly.
- Use conntrack states so new connections are admitted only where intended and replies remain stateful.
- Restrict administrative services such as SSH to known source networks whenever possible.
- Review byte and packet counters after deployment and remove stale forwards.
- Log deliberately and rate-limit logs if you add logging; unrestricted logging can consume disk and CPU during scans.
- Document the public-to-private mapping, persistence method, backend, and rollback procedure.
- Do not confuse port forwarding with application authentication, encryption, patching, or intrusion prevention.
iptables-nft, legacy iptables, and IPv6 scope
The command-line model remains familiar across iptables implementations, but backend and persistence behavior differ. Compare an implementation by its backend, IPv4/IPv6 coverage, conntrack behavior, rule rollback process, counter and logging visibility, and whether the distribution prefers nftables-native syntax. Debian’s nftables documentation describes modern NAT chain behavior, while the iptables manual documents the compatibility command set.
This guide configures IPv4 with iptables. IPv6 requires an IPv6 policy and the appropriate ip6tables or nftables configuration; do not assume that an IPv4 DNAT rule forwards IPv6 traffic. In many IPv6 designs, globally reachable addresses and firewall policy replace the need for IPv4-style address translation, so define the desired architecture before opening a port.
A complete deployment sequence
For a new forward, use this order so each dependency is validated before the next one is added:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Identify WAN and LAN interfaces, the internal server address, service port, and backend.
- Confirm direct connectivity to the service from the gateway or LAN.
- Enable and verify
net.ipv4.ip_forward=1. - Add a specific DNAT rule in
nat/PREROUTING. - Add a NEW/ESTABLISHED FORWARD rule matching the translated destination.
- Add an ESTABLISHED/RELATED rule for replies, unless an equivalent established rule already exists in your policy.
- Test from an external client and inspect counters.
- If replies take another route, fix routing; only then consider a narrowly scoped POSTROUTING SNAT or MASQUERADE rule.
- Test LAN hairpin access separately if users will use the public address internally.
- Persist both firewall rules and the forwarding sysctl through the distribution-supported mechanisms, then test recovery after restart.
Following this sequence keeps translation, filtering, and return routing separate. That separation makes a timeout diagnosable instead of turning every failed connection into a guess at a single “port-forward” command.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
