Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a domain set for my server, let's say which is being forwarded by my router and is linked to my external IP and it works fine if I ping the domain, or I do a lookup, it recognizes it and gives me the external IP of the domain. But when I listen in on any of the ports I have set to allow, it says they are closed. What rule should I set for this to forward correctly through to my router?

eth0 is my static internal interface and lo it my loop back.


eth0      Link encap:Ethernet  HWaddr 00:0e:7f:a9:10:54  
          inet addr:  Bcast:  Mask:
          inet6 addr: fe80::20e:7fff:fea9:1054/64 Scope:Link
          RX packets:8175 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5730 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:6186702 (6.1 MB)  TX bytes:1444662 (1.4 MB)

lo        Link encap:Local Loopback  
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
share|improve this question
It would help a lot if on the server you could run sudo netstat -4lnp and sudo iptables-save -c, then post the output to or some other pastebin-like site so you can give us a link to it. – Steven Kath Mar 15 '14 at 1:14

If you have a LAN behind a router with NAT you can forward ports to your routers public IP address to a private address and port in your LAN.

You could also set something usually called DMZ or something to a machine in your LAN. Then all ports will be forwarded to that machine.

All this has to be done in the router and not in your local servers iptables. There iptables will work on connection to your machine and not with NAT.

That usually works well, sort of, outside of your LAN using the public IP address of your router. It also works from your LAN using the servers private address. But if you use your public address from within your LAN, there are usually problems connecting because the router get confused. There are solutions to add ip rules in your router/NAT so it works, but then you get other problems.

Yes, NAT is an uggly hack where this is just one small problem with NAT. The real solution is to use IPv6.

To analysing this you need a machine inside the same LAN as the server and one other machine outside your LAN. You should use nmap from server with localhost, local machine and use private and global address to the server and last from the machine outside your LAN to the global address of the server/router. Also try traceroute from your local machine to your server using private and global address. For more detailed analysis use wireshark from strategical points in your LAN.

share|improve this answer
My router forwards ports 25565 (tcp) on the LAN address , on my iptables I only have ports 25565 to accept inbound connections. – user240010 Mar 11 '14 at 18:29
Do you have a program listening to the port? From what machines do you check the connection? What does nmap gives if you use the IP address? NAT and port forwarding usually works when you are outside your LAN. But if you try the global IP address from within your LAN, you can get into trouble. But the private IP address work. – Anders Mar 11 '14 at 20:06
I use to check the port. And my friend is able to ping my address from his house. – user240010 Mar 11 '14 at 20:17
The problem that you need to answer is what machine answers the request, the router or the server. It is probably the router that answers to your ping echo request feomn your friend. Open-ports would work ok, I guess to check connection from outside. – Anders Mar 11 '14 at 20:28
I assume my router responds to ping requests and the rest (ssh, telnet etc.) is answered by my system. Because the request is forwarded to it after it has passed through the firewall of the router, and then comes to the firewall of iptables where it isn't resolved properly. – user240010 Mar 11 '14 at 20:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.