Sign up ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free.

I have Ubuntu 12.04 x64 installed in my laptop.

I'm quite new to linux, and I wanted to specify certain rules for the iptables firewall.

This is the saved config of my iptables:













-A PREROUTING -p tcp -m tcp --dport 3306 -j DNAT --to-destination

-A PREROUTING -p tcp -m tcp --dport 11002 -j DNAT --to-destination

-A PREROUTING -p tcp -m tcp --dport 13000 -j DNAT --to-destination

-A PREROUTING -p tcp -m tcp --dport 13001 -j DNAT --to-destination

-A PREROUTING -p tcp -m tcp --dport 13002 -j DNAT --to-destination

-A PREROUTING -p tcp -m tcp --dport 13003 -j DNAT --to-destination

-A PREROUTING -p tcp -m tcp --dport 13004 -j DNAT --to-destination

-A PREROUTING -p tcp -m tcp --dport 13061 -j DNAT --to-destination

-A PREROUTING -p tcp -m tcp --dport 13099 -j DNAT --to-destination







-A INPUT -i eth0 -p tcp -m tcp --dport 3306 -j ACCEPT

-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT

In theory, what it does is to drop all connections in all ports except for http, mysql and few other ports.

Moreover, it redirects all mysql and 13000-13004..etc port connections to a specific local ip in the same port, which is

But what I find strange is that when my firewall is active, it blocks absolutely all the input connections, even those which must not block (http, mysql). In fact, I'm literally blocked and I can't establish any external connection.

What am I doing wrong?

PS: I tested the firewall without those redirections, and it still block all inputs, so I suppose it's not the problem.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

first and for all you need to check if forwarding packets is allowed on your system:

cat /proc/sys/net/ipv4/ip_forward


sysctl ipv4_forward

This should have the value of '1'. if not (sudo or as root):

echo '1' > /proc/sys/net/ipv4/ip_forward

and to make the change permanent you can uncomment net.ipv4.ip_forward=1 in /etc/sysctl.conf. Once this has been done you can further test your iptables settings (I presume that it will work after that minor change ;-)). Since you said that you where new to this I've placed a description of the rule under each rule hoping it all makes a bit sense to you.

iptables -P INPUT DROP

This will drop all traffic except traffic that matches the rules that are defined. -P INPUT DROP can be stated as the first rule whereas -A INPUT DROP has to be the last. The next 2 rules will allow outgoing connections and forwarding.

iptables -A INPUT -i lo -j ACCEPT

Allow loopback ( traffic

iptables -A INPUT -m state --state RELEATED,ESTABLISHED -j ACCEPT

This will allow all packets that have state RELATED (A new secondary connection f.e. FTP) or ESTABLISHED (packets for this connection has been seen in both directions f.e. HTTP traffic).

iptables -t nat -A POSTROUTING -o ethx -j MASQUERADE

nat because you probably are natting , masquerade the packet going OUT of interface ethx. F.e.: WAN side is on eth1 and lan on eth0 so ethx would be eth0. This is on the POSTROUTING.

iptables -t nat -A PREROUTING -p tcp --dport 3306 -j DNAT --to-destination

this is the actual forwarding.

So basicly your iptables rules where OK, you probably just forgot the ip_forward setting.

share|improve this answer
Thank you very much Goez, that was the problem. The reason I didn't check it was because I did change it to 1 the day before. What I didn't know is the fact that this setting became 0 again after rebooting. Now I've made a script that does it for me each time I boot. Thanks again! –  user109985 Nov 23 '12 at 13:12
@user109985 A common approach would be putting net.ipv4.ip_forward=1 in /etc/sysctl.conf so that it survives after rebooting. –  Terry Wang Aug 30 '13 at 1:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.