How to configure NAT and port redirection in iptables

What is iptables and how does it manage network traffic

Managing network traffic on Linux systems requires understanding fundamental tools that control incoming and output data. Iptables acts as a packet control utility within the system kernel, allowing administrators to define strict rules regarding the flow of information passing through the machine. In practice, it behaves like a digital traffic officer, inspecting every piece of incoming or outgoing data to decide whether it should pass, be blocked, or have its destination altered.

To understand its operation, you must know that the Linux kernel organizes traffic into specialized tables. The filtering table handles security by blocking unwanted connections, while the address manipulation table handles IP and port translation. Before applying complex commands, it is highly recommended to secure the base system, concepts you can enhance by learning how to configure firewall rules with UFW on Ubuntu, a more user-friendly alternative for daily tasks.

How network address translation works on Linux

Network address translation, commonly known as NAT, solves a classic IP address scarcity problem on the internet. In practice, it takes a data packet from an internal network with private addresses and replaces the source address with the router's public IP before sending it out. When the reply returns, the system reverses the path, ensuring the data reaches the exact computer that made the original request.

This mechanism operates mainly on two fronts within iptables: outgoing masquerading and incoming redirection. Masquerading hides the IPs of local network computers behind a single public interface. Redirection allows a server to receive a connection on a specific port and forward it to another internal device, which is essential for hosting services behind security barriers or load balancers.

How to configure IP masquerading for local networks

Sharing an internet connection among multiple machines using a central Linux server is a classic infrastructure scenario. To achieve this, the first step is enabling packet forwarding in the system kernel, allowing the server to function effectively as a router. This is done by modifying a temporary setting in the kernel's virtual file system, telling Linux to accept and forward packets destined for other networks.

With forwarding enabled, we apply the masquerading rule in the iptables nat table. In practice, we tell the system that any packet leaving through the external network interface must have its source masked. You can execute the commands below in your Linux server terminal:

sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

In this example, the eth0 interface represents the card connected to the internet. This configuration ensures local devices communicate seamlessly with external servers without needing individual public IPs.

How to redirect ports to internal servers

Exposing an internal service to the internet using a specific port requires redirection, technically known as DNAT. Imagine you run a web server on an isolated machine in your internal network at IP 192.168.1.50 on port 8080, but you want it to respond on standard port 80 of your edge router. Iptables intercepts traffic arriving at port 80 and alters the packet destination before it continues its journey.

To implement this redirection in practice, we use the prerouting chain of the nat table. See the necessary command to perform this operation on your firewall:

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.50:8080
sudo iptables -A FORWARD -p tcp -d 192.168.1.50 --dport 8080 -j ACCEPT

Besides altering packet destination, it is crucial to allow this traffic to pass through the forwarding chain so the kernel doesn't drop the connection for security reasons. To investigate connectivity faults or verify if packets are truly reaching expected destinations, check out complementary guides on how to trace IP packets and routes on Linux with traceroute.

How to save and persist iptables rules after reboot

A major trap for beginner administrators is configuring a full set of NAT rules and realizing everything disappeared after rebooting the server. By default, iptables keeps configurations only in volatile RAM. To ensure work isn't lost, specific packages must be used to save the current table states into static disk files.

In Debian and Ubuntu-based distributions, the iptables-persistent package automates saving during the operating system boot process. You can install and save your current settings by executing the following terminal commands:

sudo apt update && sudo apt install iptables-persistent
sudo netfilter-persistent save

During installation, the system will ask if you want to save current IPv4 and IPv6 rules. Confirming this step ensures redirection and masquerading rules survive unexpected power reboots or scheduled maintenance. To explore these architectural concepts further in production, see our related technical analysis on How to test the network integrated circuit with a multimeter.

Final considerations on network security and maintenance

Mastering packet manipulation and port mapping with iptables drastically expands control over Linux infrastructure environments. While modern nftables-based tools or simplified managers exist, understanding the logic behind nat and filter tables remains an indispensable technical differentiator for diagnosing complex connectivity problems. Always plan your rules carefully, validate traffic behavior, and maintain backups of your network configurations to ensure continuous operational stability.