Some firewall models allow port translation.  Meaning changing one port coming in (inbound) to some other port, using some protocol.  Furthermore, they can also change the internal port to become some external port (outbound traffic) to the original port again.This is the DMZ external firewall model below.  Suppose I want all of this to happen on the server directly using iptables instead of using the DMZ firewall.  What commands could allow this to happen on a CentOS 6 server?DMZ network rule model:Suppose I have TCP traffic and the public port is 8082 and the internal port is 8081?  So for example, Tomcat (the client) in the DMZ would send a TCP packet outside the external DMZ firewall as port 8081, and then the packet would be sent through the internet as 8082 to some public IP.  And then the reverse, suppose a request from some public IP was sent to this same server on 8082, and as it entered the DMZ of this server, the port would then change to 8081. public port = 8082internal port = 8081iptables network rule model:port external to server = 8082port Tomcat is sending and receiving TCP requests on physical server = 8081
port translation in Linux local firewall - iptables in CentOS 6
centos;iptables;tcp;port forwarding
Your solution is to use iptables to define NAT rules.For my examples, I'll refer to $physicalServerIP which is a local IP and $publicIP for your public IP.To redirect your Tomcat (assumed on $physicalServerIP) so that its attempts to connect to a server on port 8081 would actually be sent to the server on port 8082:  iptables -t nat -A PREROUTING -p tcp -s $physicalServerIP --dport 8081 -j REDIRECT --to-port 8082Incoming requests arriving at $publicIP on port 8082 can be sent to $physicalServerIP on port 8081:iptables -t nat -A PREROUTING -d $publicIP -p tcp -m tcp --dport 8082 -j DNAT --to-destination $physicalServerIP:8081To complete the previous NAT, direct the packets from $physicalServerIP to be sent (back) through the NAT on the public interface:iptables -t nat -A POSTROUTING -s $physicalServerIP/32 -j SNAT --to-source $publicIPWith this approach in mind, if you want the whole LAN to be NATed through, you could change the 32 from the previous command to 24 if your LAN is $physicalServerIP/24.