# NAT or IP Port forwarding from container **URL:** \ **Category:** balenaOS\ **Created:** [November 25, 2019, 4:56pm UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414 "2019-11-25T16:56:07Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![mbedare](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@mbedare](https://forums.balena.io/u/mbedare)\ **Post date:** [November 25, 2019, 4:56pm UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/1 "2019-11-25T16:56:07Z")
Hi I want to access local web-server behind Belea OS using public URL provided by Balena. Setup Device with webserver (192.168.100.20)----- (192.169.100.1) eth0 Baleba : Balena wlan0 (DHCP dynamic IP) ----- local wifi ----internet ---- browser Can someone please guide on how we can achive NAT/Port forwarding? I tried software approach wherein simple java socket program binds to the incoming socket and opens other TCP connection in forward direction but this is very slow (I need to deploy this on raspberry pi 3). This works perfectly fine on raspberrian using iptables -j DNAT. iptables -A PREROUTING -t nat -i wlan0 -p tcp --dport 80 -j DNAT --to 192.168.100.20:8080 iptables -A FORWARD -p tcp -d 192.168.100.20 --dport 8080 -j ACCEPT However, on Balena OS, DOCKER rules take precedence ---
**Author:** ![thundron](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/thundron/32/1379_2.png) [@thundron](https://forums.balena.io/u/thundron)\ **Post date:** [November 25, 2019, 9:37pm UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/2 "2019-11-25T21:37:15Z")
Hi, if you mean port-forwarding within the container, we have a way to do so [in the docs](https://www.balena.io/docs/faq/troubleshooting/faq/#how-can-i-forward-my-container-ports). Otherwise, could you be a bit more specific about what you’re trying to achieve? As in - what do you need port forwarding for, where from and where to? ---
**Author:** ![thundron](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/thundron/32/1379_2.png) [@thundron](https://forums.balena.io/u/thundron)\ **Post date:** [November 25, 2019, 9:39pm UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/3 "2019-11-25T21:39:12Z")
Re-reading your post though, I forgot to mention that if you _need_ to expose ports for some reason, you can do so also following the [networking docs here](https://www.balena.io/docs/learn/develop/runtime/#network) ---
**Author:** ![mbedare](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@mbedare](https://forums.balena.io/u/mbedare)\ **Post date:** [November 26, 2019, 9:34am UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/5 "2019-11-26T09:34:42Z")
Thanks for reverting but iptables -t nat does catch filter as it is overruled by DOCKER. Hence iptables can not be used to achieve what I am seeking - well unless you play with DOCKER. But disturbing DOCKER for this is not a intent. ---
**Author:** ![mbedare](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@mbedare](https://forums.balena.io/u/mbedare)\ **Post date:** [November 26, 2019, 9:36am UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/6 "2019-11-26T09:36:49Z")
No issue with public URL. It works perfectly fine. Question is about IP forwarding (NAT) not just port translation. I am able to do so using java program running in container on Balena OS but for obvious reasons, it is slow (Software opening multiple sockets and threads). There has to be some simpler way to achieve this. ---
**Author:** ![mbedare](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@mbedare](https://forums.balena.io/u/mbedare)\ **Post date:** [November 28, 2019, 3:53pm UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/8 "2019-11-28T15:53:31Z")
I am able to solve problem by blocking packet forwarding to docker (remove all iptable rules related to docker and then customizing them) iptables -t -nat -F PREROUTING iptables -t -nat -A PREROUTING -i resin-vpn -p tcp -m tcp --dport 8080 -j DNAT --to-destination 192.168.100.20:8080 ---
**Author:** ![CameronDiver](https://avatars.discourse-cdn.com/v4/letter/c/2acd7d/32.png) [@CameronDiver](https://forums.balena.io/u/CameronDiver)\ **Post date:** [November 28, 2019, 8:55pm UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/9 "2019-11-28T20:55:21Z")
Thanks for sharing, I’m glad you managed to find a solution! ---
**Author:** ![jakobsturm](https://avatars.discourse-cdn.com/v4/letter/j/59ef9b/32.png) [@jakobsturm](https://forums.balena.io/u/jakobsturm)\ **Post date:** [December 1, 2022, 7:28am UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/11 "2022-12-01T07:28:59Z")
Hi all, I am trying to achieve the same (reaching IP camera with web interface through public device URL). Unfortunately forwarding with iptables as described does not work for me. I deleted all PREROUTING and DOCKER rules from the tables and added the DNAT rule to forward from the resin-vpn interface to the IP of the camera. However I am either getting the NGINX Welcome page or an ERR\_EMPTY\_RESPONSE. Can somebody help me with this? ---
**Author:** ![jakobsturm](https://avatars.discourse-cdn.com/v4/letter/j/59ef9b/32.png) [@jakobsturm](https://forums.balena.io/u/jakobsturm)\ **Post date:** [December 5, 2022, 3:33pm UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/12 "2022-12-05T15:33:48Z")
Got it working finally. In the end I needed these rules to be set: ```auto iptables -t nat -A PREROUTING -i resin-vpn -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.100 iptables -A FORWARD -d 192.168.0.100 -p tcp -m tcp --dport 80 -j ACCEPT iptables -A FORWARD -o resin-vpn -j ACCEPT iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE ``` The missing puzzle piece was to take care of the route back from the device by setting the POSTROUTING rule. Also I didn’t have to change anything regarding the DOCKER rules, probably because my containers are running in host mode. ---
**Author:** ![mpous](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/mpous/32/4742_2.png) [@mpous](https://forums.balena.io/u/mpous)\ **Post date:** [December 5, 2022, 3:40pm UTC](https://forums.balena.io/t/nat-or-ip-port-forwarding-from-container/46414/13 "2022-12-05T15:40:17Z")
Thanks @jakobsturm for posting the solution! BTW welcome to the balena community!