iptables: Duplicating/Forwarding ports

I'm trying to connect to MySQL (Port 3306) from a network which blocks this port. But there is another port 110 open which I can use for this case. I'm using MySQL for other applications so I can't just simply change the port.

I'm now trying to set up port forwarding via iptables. To be exact I want to forward 110 to 3306 without blocking 3306.

I've spent a lot of time googling, but I couldn't get it working. I'm also a little worried about locking me out. Can any of you give me a hint?

Thank you very much!

#~ iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            state INVALID limit: avg 2/sec burst 5 LOG level warning prefix `INPUT INVALID ' 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
DROP       all  --  anywhere             anywhere            state INVALID 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,RST/FIN,RST 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,SYN/FIN,SYN 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,ACK/FIN 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,RST/FIN,RST 
MY_DROP    tcp  --  anywhere             anywhere            tcp flags:FIN,ACK/FIN 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp source-quench 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
ACCEPT     icmp --  anywhere             anywhere            icmp time-exceeded 
ACCEPT     icmp --  anywhere             anywhere            icmp parameter-problem 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:www 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:smtp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssmtp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:pop3s 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:imap2 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:imaps 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:nntp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:domain 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:domain 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:ntp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:6060 
MY_REJECT  all  --  anywhere             anywhere            
MY_REJECT  all  --  anywhere             anywhere            

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            state INVALID limit: avg 2/sec burst 5 LOG level warning prefix `OUTPUT INVALID ' 
DROP       all  --  anywhere             anywhere            state INVALID 
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-reply 
ACCEPT     icmp --  anywhere             anywhere            icmp destination-unreachable 
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request 
MY_REJECT  all  --  anywhere             anywhere            

Chain MY_DROP (7 references)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `PORTSCAN DROP ' 
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `PORTSCAN DROP ' 
DROP       all  --  anywhere             anywhere            

Chain MY_REJECT (3 references)
target     prot opt source               destination         
LOG        tcp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT TCP ' 
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset 
LOG        tcp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT TCP ' 
LOG        udp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT UDP ' 
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset 
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable 
LOG        udp  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT UDP ' 
DROP       icmp --  anywhere             anywhere            
开发者_JAVA技巧REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable 
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT OTHER ' 
LOG        icmp --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `DROP ICMP ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable 
DROP       icmp --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere            limit: avg 2/sec burst 5 LOG level warning prefix `REJECT OTHER ' 
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable

When forwarding ports on ubuntu using iptables, you must:

• make a backup of your firewall settings

sudo iptables-save > iptables.backup

• make sure the entry port is open

sudo ufw allow 110/tcp

• add a prerouting rule in your firewall

sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 110 -j REDIRECT --to-port 3306

Notice the use of -i eth0. This routes port 110 to 3306 on network eth0. To check all connection of your machine, use ifconfig.
If your machine is connected to multiple networks, you must use -i <network> or it will not work!

• if you mess something up you can clean the NAT routing table with

sudo iptables -F -t nat

or restore iptables

sudo iptables-restore < iptables.backup

This might work, haven't tested it.

iptables -t nat -A PREROUTING -p tcp --dport 110 -j REDIRECT --to-port 3306