Port Mapping with iptables?

I have a linux machine running iptables which I use as my router. I have
several machines behind the router and I wish to map incoming ports from the
outside world to different ports on one of the internal machines. At the
moment I use the following commands to forward a port keeping the port
number the same:

iptables -t nat -I PREROUTING -p tcp -s ! 192.168.1.104 --dport 3333 -j
DNAT --to 192.168.0.104
iptables -I FORWARD -p tcp -d 192.168.1.104 --dport 3333 -j ACCEPT

How can I change this so I can map say port 4444 externally to port 3333
internally?

Thanks
Allan

Allan Bruce wrote:

> I have a linux machine running iptables which I use as my router. I have
> several machines behind the router and I wish to map incoming ports from
> the
> outside world to different ports on one of the internal machines. At the
> moment I use the following commands to forward a port keeping the port
> number the same:
>
> iptables -t nat -I PREROUTING -p tcp -s ! 192.168.1.104 --dport 3333 -j
> DNAT --to 192.168.0.104
> iptables -I FORWARD -p tcp -d 192.168.1.104 --dport 3333 -j ACCEPT
>
> How can I change this so I can map say port 4444 externally to port 3333
> internally?
>
> Thanks
> Allan
You could try this

iptables -A PREROUTING -t nat -p tcp -d $EXTIP --dport 4444 -j DNAT --to
$INTIP:3333

If I got you right.

~pete

"Allan Bruce" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>I have a linux machine running iptables which I use as my router. I have
>several machines behind the router and I wish to map incoming ports from
>the outside world to different ports on one of the internal machines. At
>the moment I use the following commands to forward a port keeping the port
>number the same:
>
> iptables -t nat -I PREROUTING -p tcp -s ! 192.168.1.104 --dport 3333 -j
> DNAT --to 192.168.0.104
> iptables -I FORWARD -p tcp -d 192.168.1.104 --dport 3333 -j ACCEPT

I use a similar DNAT setup and find the following works fine.

iptables -t nat -A PREROUTING -i $INTIF -p tcp --dport 3333 -j
DNAT --to-dest 192.168.0.104:4444

Which should map 3333 to 4444 on the internal machine.

I presume you'd need to allow traffic through on the new port as well if you
block it by default.

HTH.

Dave.