I have Ubuntu 18.04.2 with l2tp vpn server, installed by a script. My client runs Windows 7 and connects to this server, internet works perfectly, connection is secured. I need to forward the rdp port from the external vpn server's ip. Local connection to this client works clear, but not from the outside. I use this:

iptables -t nat -A PREROUTING -i eth0 -d 5.253.x.x -p tcp --dport 55658 -j DNAT --to-destination

port 55658 is opened on the router

result of iptables-save:

:INPUT ACCEPT [731:39193]
:OUTPUT ACCEPT [126833:135018308]
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j DROP
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -i eth0 -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -o eth0 -j ACCEPT
-A FORWARD -s -d -i ppp+ -o ppp+ -j ACCEPT
-A FORWARD -d -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s -o eth0 -j ACCEPT

:INPUT ACCEPT [31:1477]
-A PREROUTING -d 5.253.x.x/32 -i eth0 -p tcp -m tcp --dport 55658 -j DNAT --to-destination
-A POSTROUTING -s -o eth0 -m policy --dir out --pol none -j MASQUERADE

Help me please, I'm stuck


1 Answer 1


This might be nothing, but I've never seen *nat below *filter. What documentation or guides are you following?

Here is an example, using Minecraft, its port and additional port:

-A PREROUTING -i eth0 -p tcp -m multiport --dports 25565,8888 -j DNAT --to-destination
-A INPUT -i eth0 -p tcp -m multiport --dports 25565,8888 -m state --state NEW,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -p tcp -m multiport --dports 25565,8888 -d -j ACCEPT

First, we allow for the PREROUTING from this port, to the same port at the destination. You can use --to-destination if you wish to adjust the port. Then, we have to create a filter to ensure we don't DROP or REJECT these packets. We limit this to NEW,ESTABLISHED, and have a rule to allow for all RELATED,ESTABLISHED traffic. This results in new and existing connections being allowed.

I do not see a local, or lo rule. Typically local traffic is -j ACCEPT early in the chain. You will likely run into issues if you do not handle lo properly. Be sure you're properly loading these new rules, and confirming the rules match your intent:

sudo iptables -L

Remember, you may want to iptables --flush before loading new tables to test. This will prevent issues with stale information messing up your changes, as well as ensure you understand how the tables will look fresh, such as when rebooting the system.

  • thank you for your answer, I've just removed FORWARD -j DROP and it worked out. So I need to put PREROUTING -d 5.253.x.x/32 -i eth0 -p tcp -m tcp --dport 55658 -j DNAT --to-destination above it, but I don't know where it stored. All these instructions were made by the script. Don't you know where that magic place could be? May 24, 2019 at 14:36
  • computingforgeeks.com/… I used this script May 24, 2019 at 14:42
  • I added this string to /etc/iptables.rules but it doesn't work May 24, 2019 at 15:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .