I am in a bit of trouble as I am trying to setup a reverse proxy with and a second server. My idea was to get the firewall to forward https to the reverse proxy and port 29418 (gerrit ssh) to the second server. Now my cooperate IT guy says: CAN NOT! Either both ports go to server 1 or both ports go to server 2.

Ok, as a work around I tried to setup a port forwarding on the reverse proxy of port 29418 -> server2:29418


  • Server1 IP: and on Ubuntu 12.04.2 LTS
  • Server2 IP: and on Ubuntu 12.04.2 LTS

Now both https and port 29418 go from the firewall to, IT says that's the only way. :(

So please tell me how to forward from -> or

When I am working on the I can connect to both and so the ports are open.

-- Update --

My iptables -t nat -L looks like this:

root@dev:/root# iptables -t nat -L
target     prot opt source               destination
DNAT       tcp  --  anywhere             dev.example.com       tcp dpt:29418 to:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

target     prot opt source               destination
root@dev:/root# cat /proc/sys/net/ipv4/ip_forward
  • I find this article useful. The main issue to enable ipforward in linux is described in the section "Configuring the Firewall to Forward Port 80" Jul 23, 2020 at 10:48

4 Answers 4


In case someone else is looking for a way that actually works. Though @HorsePunchKid is right in his suggestion, I've found this walkthrough that fills in the missing steps:


In essence:

Enable IP Forwarding:

sysctl net.ipv4.ip_forward=1

Add your forwarding rule (use n.n.n.n:port):

iptables -t nat -A PREROUTING -p tcp -d --dport 29418 -j DNAT --to-destination

Ask IPtables to Masquerade:

iptables -t nat -A POSTROUTING ! -s -j MASQUERADE

And that's it! It worked for me in any case :)

  • 2
    This is the best answer I found on this subject. Sep 19, 2014 at 8:34
  • Lost connection from my Docker container after using this solution. Had to delete the rule. Rule was working, but lost all other traffic. I don't recommend this.
    – Dyin
    Nov 19, 2016 at 16:27
  • iptables -t nat -A POSTROUTING -j MASQUERADE OH WOW... that's it, thank you! Spent hours searching web and figuring out. This is so simple and works. Apr 26, 2018 at 14:22
  • It works perfectly, Now, how to make these rules permanent?
    – vmalep
    Jan 15, 2020 at 21:13
  • A problem I noticed is that when the port forwarding is activated, the router cannot access the apt servers anymore... Any clue?
    – vmalep
    Jan 15, 2020 at 21:23

If anyone is searching for a temporary method, try the below solution.

ssh -L [email protected]

The above command redirects all connections to port 8080 on your base machine to 80 virtual machine ports. You can test if it works by accessing the web page, and it'll show you the web page on the guest machine.

This applies to all ports :)


If you have iptables installed on, I think this will be pretty straightforward:

iptables -t nat -A PREROUTING -j DNAT -d -p tcp --dport 29418 --to

This says to send traffic coming in to on port 29418 over to instead, on the same port, prior to any other routing that might try to do. If you run this command and have trouble with it, replace the -A flag with -D to remove it.

If you're looking to have this rule run automatically when starts up, consider adding the above command as a "post-up" rule in /etc/network/interfaces.

  • 1
    That's exactly what I did but it didn't work. I have uncommented the net.ipv4.ip_forward = 1 in /etc/sysctl.conf but I still get errors connecting to the
    – uncletall
    Jul 15, 2013 at 2:39

In the end I had to install pfSense as a router inside my ESXi server to route the traffic to the different VM's as I could not get it to work in Ubuntu.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .