So while I have glanced through the forms to find if someone else has had the same issue, but I feel like my situation is particularly isolated/special. (I guess anyways)

I am trying to run the rdesktop/remote desktop application through my modem/router and my Ubuntu DHCP server to a system on the subnet(or sub-lan). I have forwarded the port (3389) through my modem/router and have it redirect the traffic to my Ubuntu DHCP server. From that, using netstat, the port 3389 is not blocked but closed (on my DHCP server)(not sure if it matters that it needs to be listening?). When I check to see if the port is open (through the modem/router and DHCP server), the results I have gotten say that the port is still closed. I know the packet is making it pass the port on the router/modem because I have remotely connected to a system on the LAN through the modem/router successfully. Due to my setup however I wish to remotely access the system from the sub-lan. (modem/router --> LAN --> DHCP server --> sub-LAN/net, incase the terminology seems confusing.)

Can anyone offer a solution? I can work around this but my ideal setup should be possible? (at least I think so)

Here is my iptable(s) content, thank you!

/sbin/iptables -P FORWARD ACCEPT
/sbin/iptables -A FORWARD -i enp5s0 -j ACCEPT
/sbin/iptables --table nat -A POSTROUTING -o enp0s25 -j MASQUERADE

exit 0

  • 2
    Edit your answer and add iptables content. A DHCP server does not port forward, the NAT/router does. – Kryštof Píštěk Sep 5 '17 at 13:15

You only have outbound NAT set up so that everything going through the system masquerades with the primary IP address and route to the Internet. You don't have any port forwarding done. Just like on standard off-the-shelf routers, you need to configure NAT rules to handle traffic coming from the outside and going in.

iptables basic port forwarding for TCP traffic is like this:


... with a corresponding rule in your FORWARD table like this:

iptables -A FORWARD -p tcp -d [TARGET_SYSTEM_IP] --dport [TARGET_PORT] -m conntrack --ctstate NEW,ESTABLISHED,RELATED -j ACCEPT

For UDP traffic, it's similar except without state tracking:

iptables -t nat -A PREROUTING -i [INTERNET_INTERFACE] -p udp --dport [EXTERNAL_RECEIVING_PORT] -j DNAT --to-destination [TARGET_SYSTEM_IP]:[PORT]
iptables -A FORWARD -p udp -d [TARGET_SYSTEM_IP] --dport [TARGET_PORT] -j ACCEPT

The assumption here, though, is that you have two system interfaces, one for outgoing traffic, and the other for incoming traffic from your LAN, with your system acting as the gateway.

Consider, though, that your Ubuntu server is likely not just doing DHCP, but is acting as the router on your infrastructure, which means you have to treat it as such. (It's not just DHCP, it's the NAT and routing system)

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.