I need a temporary redirection of some ports to another machine.I've tried:iptables -t nat -A PREROUTING -p tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80But shorewall blocks all packages. So I've tried: iptables -A FORWARD -d 192.168.121.4 -p tcp --dport 80 -j ACCEPTWhich is also not working. So how can I redirect/forward the port 4321 proberly to port 80 on machine 192.168.121.4?And how can I afterwards unredirect/unforward this?I've also set: sysctl net.ipv4.ip_forward=1I'm on Linux/Ubuntu 12.04iptables-save:# Generated by iptables-save v1.4.12 on Mon Jun 23 12:53:49 2014*raw:PREROUTING ACCEPT [5287371:7459454675]:OUTPUT ACCEPT [4550885:6177804756]COMMIT# Completed on Mon Jun 23 12:53:49 2014# Generated by iptables-save v1.4.12 on Mon Jun 23 12:53:49 2014*nat:PREROUTING ACCEPT [227:17856]:INPUT ACCEPT [33:2188]:OUTPUT ACCEPT [53:3832]:POSTROUTING ACCEPT [53:3832]:eth0_masq - [0:0]-A PREROUTING -p tcp -m tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80-A PREROUTING -p tcp -m tcp --dport 4321 -j DNAT --to-destination 192.168.121.4:80-A POSTROUTING -o eth0 -j eth0_masq-A eth0_masq -s 169.254.0.0/16 -j MASQUERADE-A eth0_masq -s 192.168.121.0/24 -j MASQUERADECOMMIT# Completed on Mon Jun 23 12:53:49 2014# Generated by iptables-save v1.4.12 on Mon Jun 23 12:53:49 2014*mangle:PREROUTING ACCEPT [5287371:7459454675]:INPUT ACCEPT [5081977:7360915410]:FORWARD ACCEPT [205394:98539265]:OUTPUT ACCEPT [4550885:6177804756]:POSTROUTING ACCEPT [4756960:6276393466]:tcfor - [0:0]:tcin - [0:0]:tcout - [0:0]:tcpost - [0:0]:tcpre - [0:0]-A PREROUTING -j tcpre-A INPUT -j tcin-A FORWARD -j MARK --set-xmark 0x0/0xff-A FORWARD -j tcfor-A OUTPUT -j tcout-A POSTROUTING -j tcpostCOMMIT# Completed on Mon Jun 23 12:53:49 2014# Generated by iptables-save v1.4.12 on Mon Jun 23 12:53:49 2014*filter:INPUT DROP [0:0]:FORWARD DROP [0:0]:OUTPUT DROP [0:0]:%Invalid - [0:0]:Broadcast - [0:0]:Drop - [0:0]:Invalid - [0:0]:NotSyn - [0:0]:Reject - [0:0]:dynamic - [0:0]:eth0_fwd - [0:0]:eth0_in - [0:0]:fw2net - [0:0]:fw2sky - [0:0]:logdrop - [0:0]:logflags - [0:0]:logreject - [0:0]:net2fw - [0:0]:net2sky - [0:0]:net_frwd - [0:0]:reject - [0:0]:shorewall - [0:0]:sky2fw - [0:0]:sky2net - [0:0]:smurflog - [0:0]:smurfs - [0:0]:tcpflags - [0:0]:wlan0_fwd - [0:0]:wlan0_in - [0:0]-A INPUT -m conntrack --ctstate INVALID,NEW -j dynamic-A INPUT -i eth0 -j eth0_in-A INPUT -i wlan0 -j wlan0_in-A INPUT -i eth1 -j sky2fw-A INPUT -i lo -j ACCEPT-A INPUT -j Reject-A INPUT -j LOG --log-prefix Shorewall:INPUT:REJECT: --log-level 6-A INPUT -g reject-A FORWARD -i eth0 -j eth0_fwd-A FORWARD -i wlan0 -j wlan0_fwd-A FORWARD -i eth1 -o wlan0 -j sky2net-A FORWARD -i eth1 -o eth0 -j sky2net-A FORWARD -j Reject-A FORWARD -j LOG --log-prefix Shorewall:FORWARD:REJECT: --log-level 6-A FORWARD -g reject-A FORWARD -d 192.168.121.4/32 -p tcp -m tcp --dport 4242 -j ACCEPT-A FORWARD -d 192.168.121.4/32 -p tcp -m tcp --dport 80 -j ACCEPT-A OUTPUT -o eth0 -j fw2net-A OUTPUT -o wlan0 -j fw2net-A OUTPUT -o eth1 -j fw2sky-A OUTPUT -o lo -j ACCEPT-A OUTPUT -j ACCEPT-A %Invalid -m conntrack --ctstate INVALID -j DROP-A Broadcast -m addrtype --dst-type BROADCAST -j DROP-A Broadcast -m addrtype --dst-type MULTICAST -j DROP-A Broadcast -m addrtype --dst-type ANYCAST -j DROP-A Broadcast -d 224.0.0.0/4 -j DROP-A Drop-A Drop -p tcp -m tcp --dport 113 -m comment --comment Auth -j reject-A Drop -j Broadcast-A Drop -p icmp -m icmp --icmp-type 3/4 -m comment --comment Needed ICMP types -j ACCEPT-A Drop -p icmp -m icmp --icmp-type 11 -m comment --comment Needed ICMP types -j ACCEPT-A Drop -j Invalid-A Drop -p udp -m multiport --dports 135,445 -m comment --comment SMB -j DROP-A Drop -p udp -m udp --dport 137:139 -m comment --comment SMB -j DROP-A Drop -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment SMB -j DROP-A Drop -p tcp -m multiport --dports 135,139,445 -m comment --comment SMB -j DROP-A Drop -p udp -m udp --dport 1900 -m comment --comment UPnP -j DROP-A Drop -p tcp -j NotSyn-A Drop -p udp -m udp --sport 53 -m comment --comment Late DNS Replies -j DROP-A Invalid -m conntrack --ctstate INVALID -j DROP-A NotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP-A Reject-A Reject -p tcp -m tcp --dport 113 -m comment --comment Auth -j reject-A Reject -j Broadcast-A Reject -p icmp -m icmp --icmp-type 3/4 -m comment --comment Needed ICMP types -j ACCEPT-A Reject -p icmp -m icmp --icmp-type 11 -m comment --comment Needed ICMP types -j ACCEPT-A Reject -j Invalid-A Reject -p udp -m multiport --dports 135,445 -m comment --comment SMB -j reject-A Reject -p udp -m udp --dport 137:139 -m comment --comment SMB -j reject-A Reject -p udp -m udp --sport 137 --dport 1024:65535 -m comment --comment SMB -j reject-A Reject -p tcp -m multiport --dports 135,139,445 -m comment --comment SMB -j reject-A Reject -p udp -m udp --dport 1900 -m comment --comment UPnP -j DROP-A Reject -p tcp -j NotSyn-A Reject -p udp -m udp --sport 53 -m comment --comment Late DNS Replies -j DROP-A eth0_fwd -m conntrack --ctstate INVALID,NEW -j dynamic-A eth0_fwd -m conntrack --ctstate INVALID,NEW -j smurfs-A eth0_fwd -p tcp -j tcpflags-A eth0_fwd -j net_frwd-A eth0_in -m conntrack --ctstate INVALID,NEW -j dynamic-A eth0_in -m conntrack --ctstate INVALID,NEW -j smurfs-A eth0_in -p udp -m udp --dport 67:68 -j ACCEPT-A eth0_in -p tcp -j tcpflags-A eth0_in -j net2fw-A fw2net -p udp -m udp --dport 67:68 -j ACCEPT-A fw2net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A fw2net -p udp -m udp --dport 53 -m comment --comment DNS -j ACCEPT-A fw2net -p tcp -m tcp --dport 53 -m comment --comment DNS -j ACCEPT-A fw2net -p icmp -j ACCEPT-A fw2net -j ACCEPT-A fw2sky -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A fw2sky -j ACCEPT-A logdrop -j DROP-A logflags -j LOG --log-prefix Shorewall:logflags:DROP: --log-level 6 --log-ip-options-A logflags -j DROP-A logreject -j reject-A net2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A net2fw -j %Invalid-A net2fw -p tcp -m tcp --dport 22 -m comment --comment SSH -j ACCEPT-A net2fw -p tcp -m multiport --dports 4242,4243,24800 -j ACCEPT-A net2fw -p icmp -m icmp --icmp-type 8 -m comment --comment Ping -j ACCEPT-A net2fw -p icmp -m icmp --icmp-type 8 -m comment --comment Ping -j DROP-A net2fw -p tcp -m tcp --dport 80 -j ACCEPT-A net2fw -j Drop-A net2fw -j LOG --log-prefix Shorewall:net2fw:DROP: --log-level 6-A net2fw -j DROP-A net2sky -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A net2sky -j %Invalid-A net2sky -j Drop-A net2sky -j LOG --log-prefix Shorewall:net2sky:DROP: --log-level 6-A net2sky -j DROP-A net_frwd -o eth0 -j ACCEPT-A net_frwd -o wlan0 -j ACCEPT-A net_frwd -o eth1 -j net2sky-A reject -m addrtype --src-type BROADCAST -j DROP-A reject -s 224.0.0.0/4 -j DROP-A reject -p igmp -j DROP-A reject -p tcp -j REJECT --reject-with tcp-reset-A reject -p udp -j REJECT --reject-with icmp-port-unreachable-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable-A reject -j REJECT --reject-with icmp-host-prohibited-A sky2fw -m conntrack --ctstate INVALID,NEW -j dynamic-A sky2fw -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A sky2fw -j ACCEPT-A sky2net -m conntrack --ctstate INVALID,NEW -j dynamic-A sky2net -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT-A sky2net -j ACCEPT-A smurflog -j LOG --log-prefix Shorewall:smurfs:DROP: --log-level 6-A smurflog -j DROP-A smurfs -s 0.0.0.0/32 -j RETURN-A smurfs -m addrtype --src-type BROADCAST -g smurflog-A smurfs -s 224.0.0.0/4 -g smurflog-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -g logflags-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -g logflags-A tcpflags -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -g logflags-A tcpflags -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -g logflags-A tcpflags -p tcp -m tcp --sport 0 --tcp-flags FIN,SYN,RST,ACK SYN -g logflags-A wlan0_fwd -m conntrack --ctstate INVALID,NEW -j dynamic-A wlan0_fwd -m conntrack --ctstate INVALID,NEW -j smurfs-A wlan0_fwd -p tcp -j tcpflags-A wlan0_fwd -j net_frwd-A wlan0_in -m conntrack --ctstate INVALID,NEW -j dynamic-A wlan0_in -m conntrack --ctstate INVALID,NEW -j smurfs-A wlan0_in -p udp -m udp --dport 67:68 -j ACCEPT-A wlan0_in -p tcp -j tcpflags-A wlan0_in -j net2fwCOMMIT# Completed on Mon Jun 23 12:53:49 2014
Temporary redirect ports
iptables;firewall;port forwarding;nat