Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What I want to do is say that for all UDP connections on interface ppp0 that have a destination port of 53, change that destination port to 1053.

I am attempting to change the destination port of UDP packets for VPN clients connected via PPTP on Ubuntu.

This question: suggests that this can be done using NAT at the --to-destination option, for example:

iptables -t nat -A OUTPUT -p udp --dport 53 -j DNAT --to-destination x.x.x.x:1053

This does work but it changes the port for ALL packets going out on port 53 but I only want to chane the port for some of my VPN clients who are connected on interface ppp0-255 and IP range

I have tried adding the source into the statement, for example:

iptables -t nat -A OUTPUT -s -p udp --dport 53 -j DNAT --to-destination x.x.x.x:1053

This however does not appear to work and the VPN connections still go through to port 53.

Any ideas?

share|improve this question
Do you have IP forwarding enabled at the VPN Server? – Mitch May 29 '13 at 8:20
yes, IP forwarding is enabled.. the VPN client can route through the VPN without any problems. What I want to do is for some users change their DNS server so in ip-up add a firewall command that changes the port of the DNS server to a different server listening on a different port. – user1167223 May 29 '13 at 8:22

Try the following rule:

iptables -t nat -A PREROUTING -i ppp+ -p udp --dport 53 -j REDIRECT --to-port 1053

I have not tried it but it should work.

Good luck!

share|improve this answer
This seems to do something but I'm not sure what. On the face of it things should work as expected but my VPN traffic simply looses the ability to connect to the DNS even though it is listening on 1053. – user1167223 May 29 '13 at 13:31
oops, enter submit! It's almost as if the ports are wrong but if I use nslookup and set the port to 1053 I can resolve as expected. Any ideas? – user1167223 May 29 '13 at 13:32
Thats strange. What does iptables -L show? – ortang May 29 '13 at 14:20
So you have two dns servers running i assume: one on port 53 for the normal usage and one on port 1053 for the pptp clients? – ortang May 29 '13 at 14:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.