Skip to main content
To set up port forwarding with iptables, enable IP forwarding (net.ipv4.ip_forward=1), add a DNAT rule such as sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 10.0.0.2:80, allow the traffic in the FORWARD chain, and add a MASQUERADE rule so replies come back through your server. Save the rules so they survive a reboot. With UFW, put the rules in /etc/ufw/before.rules; on AlmaLinux/Rocky, use firewall-cmd --add-forward-port.

​
Before you start

  • Port forwarding sends connections that arrive on one port of your server to another port or another machine. NAT (network address translation) rewrites the addresses in those packets. DNAT changes the destination; MASQUERADE changes the source to your server’s address.
  • Typical uses: reach a service on a machine behind a private network or VPN (for example WireGuard), move a service to another port, or give a private network internet access.
  • The examples use eth0 as the public interface, wg0 as the private one and 10.0.0.2 as the target. Find your interface names with ip -br addr.
  • Open the VNC console first. A wrong rule can cut your SSH connection.
  • Commands use sudo; as root, leave it out.
Never run iptables -F or change the INPUT policy over SSH without a console open. Port forwarding rules only touch the nat table and the FORWARD chain, so your SSH access stays as it is if you follow the steps below.

​
How to enable IP forwarding

Linux doesn’t pass packets between interfaces until forwarding is on (the kernel default is 0).
The last command should print net.ipv4.ip_forward = 1.

​
How to forward a port to another machine

If UFW is your firewall (sudo ufw status shows Status: active), add the rules through UFW, as in the ufw-framework manual. UFW drops forwarded traffic by default (DEFAULT_FORWARD_POLICY="DROP").
1

Enable forwarding for UFW

Remove the # in front of net/ipv4/ip_forward=1. UFW applies this file when it starts, so set forwarding here as well as in the section above.
2

Add the NAT rules

Add this at the end of the file, after the last COMMIT of the *filter section:
3

Allow the forwarded traffic

4

Reload UFW

The rules are stored in UFW’s files and survive reboots.

​
How to redirect one port to another on the same server

To accept connections on port 2222 and send them to a service on port 22 of the same server:
No forwarding or masquerading is needed for this.

​
How to give a private network internet access (NAT)

If machines on 10.0.0.0/24 (for example VPN clients) should reach the internet through your server:
IP forwarding must be on, as above. Save with sudo netfilter-persistent save, or with UFW use the masquerade example in the ufw-framework manual.

​
How to check it worked

The packet counters (pkts) on your rules go up when traffic matches. Then test from outside: nc -zv 203.0.113.10 8080 (see check if a port is open). To remove a rule, delete it by its number, for example sudo iptables -t nat -D PREROUTING 1, then save again.

​
Frequently asked questions

​
Why doesn’t my port forward work?

Check, in order: net.ipv4.ip_forward = 1; the DNAT rule’s counter increases; the FORWARD chain (or a ufw route rule) allows the traffic; the MASQUERADE rule exists or the target routes back through you; the target service listens on the right port.

​
Does this work for UDP, such as game servers?

Yes. Use -p udp in the DNAT, FORWARD and MASQUERADE rules (or proto=udp in firewalld). Add a second set of rules if you need both TCP and UDP.

​
Are these iptables or nftables rules?

On current Ubuntu, Debian, AlmaLinux and Rocky releases, the iptables command uses the nftables back end (iptables -V shows nf_tables). The syntax above still applies. See nftables and iptables.

​
How do I forward IPv6?

IPv6 uses ip6tables and net.ipv6.conf.all.forwarding=1. firewalld’s --add-forward-port is IPv4 only; IPv6 forwarding there needs a rich rule.

VPS and dedicated server guides

Every guide in this section.

nftables and iptables

Firewall rules in depth.

Set up a WireGuard VPN

A private network to forward into.

Check if a port is open

Test the forward from outside.

Set up firewalld

Zones and rules on AlmaLinux and Rocky.

Locked out after a firewall change

Recover access with the console.
Checked against the ufw-framework manual, the firewall-cmd manual and the Linux kernel IP sysctl documentation on 4 November 2026; the iptables rules were validated with iptables-restore --test (iptables 1.8.10, nf_tables) the UFW route rule with ufw --dry-run, and the iptables-persistent/UFW conflict with apt-get install -s on Ubuntu 24.04 LTS, without applying any rules. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026