8

I use UFW on my Ubuntu server. Unfortunately there are no rules in UFW to port-forward to another machine.
What you need to do is edit /etc/ufw/before.rules and put routing commands there, for example

# nat Table rules
*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic from eth0 through eth1.
-A POSTROUTING -s 192.168.0.0/24 -o eth1 -j MASQUERADE
-A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.0.200:80
-A PREROUTING -i eth1 -p udp --dport 10090 -j DNAT --to 192.168.0.202:22
-A PREROUTING -i eth1 -p tcp --dport 10090 -j DNAT --to 192.168.0.202:22
-A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to 192.168.0.200:443
-A PREROUTING -i eth1 -p udp --dport 443 -j DNAT --to 192.168.0.200:443
-A PREROUTING -i eth1 -p tcp --dport 57626 -j DNAT --to 192.168.0.2:57626
-A PREROUTING -i eth1 -p udp --dport 57626 -j DNAT --to 192.168.0.2:57626
-A PREROUTING -i eth1 -p tcp --dport 3306 -j DNAT --to 192.168.0.200:3306
-A PREROUTING -i eth1 -p udp --dport 3306 -j DNAT --to 192.168.0.200:3306

COMMIT

My problem is that I can't find a way to run new forwarding rules without restarting the server, which I hate to do very much.
So please help me, is there a way?

Improve this question
1
  • I think I've tried every answer in this, and couldn't find a solution, short of rebooting (which did work). :'( I'd love to see a better answer to this. Strangely, it seemed like the rules were in place after some of these answers (as indicated by iptables -t nat -L), but the packets I cared about (ICMP) weren't being masqueraded (but rather being forwarded without NAT, and thus not returned). Here's hoping an answer can be found.
    – lindes
    Jan 10, 2023 at 5:43

6 Answers 6

Reset to default
11

This works for me:

sudo service ufw restart
Improve this answer
4
  • 2
    As I understand it, this is wrong. As in won't even load the new rules. See my question and this bug report (which has been marked as won't fix). Can anyone else confirm this actually working after changing rules in /etc/before.rules?
    – Nateowami
    Mar 22, 2016 at 10:17
  • @Nateowami This solution works fine for me.
    – Matt Borja
    Jul 7, 2016 at 23:35
  • @MattBorja What version of Ubuntu and ufw? I really don't know much in this area; I've just been going on the bug report which basically said this was intended behavior, and my own experience.
    – Nateowami
    Jul 8, 2016 at 0:48
  • This also doesn't work for me. Ubuntu 20.04. Added a DNAT rule to port-forward, which worked after reloading, but after removing the rule, the port still gets forwarded.
    – Rob
    Oct 6, 2021 at 19:07
2

It is as simple as it looks:

sudo ufw disable && sudo ufw enable
Improve this answer
1
  • This does not work.
    – Rob
    Oct 6, 2021 at 19:04
1

Well

sudo iptables-restore < /etc/before.rules

might work.

Improve this answer
1
  • /etc/ufw/before.rules is not a valid iptables format, so this doesn't work.
    – Rob
    Oct 6, 2021 at 19:05
1

Had the same issue, following works on Ubuntu 20.04.

Flush chains and restart ufw:

sudo /usr/lib/ufw/ufw-init flush-all
sudo service ufw restart
Improve this answer
0 
/etc/init.d/networking restart
/etc/init.d/ufw restart

Source

Improve this answer
0

How about 

sudo service ufw reload
Improve this answer
2
  • @karel reload is not the same as restart.
    – Eliah Kagan
    Jan 9, 2020 at 9:06
  • This does not work.
    – Rob
    Oct 6, 2021 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .