iptables to forward to another ip

[m_cma]

Was just wondering. I need to forward all the packets I get on one interface that are going to a specific port and then forward those messages to another server? Would iptables be the tool to use for this? If so how do I do it? Thanks.

[bwkaz]

Yes, it would.

Check the Firewalling-HOWTO (or one of those; it might actually be in the IP Masquerading HOWTO) at www.tldp.org for more info, but AFAIK it's something like:

iptables -t nat -A PREROUTING --proto tcp --dport 80 -j DNAT --to-destination <internal IP>:80

Change the --dport 80 and the :80 if you want to redirect something other than HTTP.

You may have to have other rules allowing return packets out, as well, I don't know for sure. And there may be issues with internal LAN clients trying to connect, I remember reading something about that.

[m_cma]

Thank you that does give me a direction to look in. However I didn't mean natting, I meant using it with an application server to redirect requests coming in on a specific port to another application server.

[bwkaz]

The only reason NAT is mentioned at all in that rule is because you need the DNAT target to be used in order to change where the packet is going. And the DNAT target can only be used in the "nat" table, in the PREROUTING (and I think OUTPUT) chains, so that's why I have a -t nat.

And it is NAT. It's not IP Masquerading, but it is network address translation. You're translating from your router's address to the address of another computer accessible from the router.