Port forwarding from external to internal isolated LAN


New Member
Dec 21, 2023
I feel like this should have been straight forward but not working. Basically I have two bridge networks vmbr0 ( and on my home LAN) & vmbr1 ( and isolated). I have VM1 ( attached to vmbr1. The proxmox host is at
Summarizing the setup:
vmbr0 GW
vmbr1 No GW
Proxmox host:
Home LAN: GW
Source computer on home network:
From a computer ( on my home network I'm sending tcp data:
echo this | netcat 3002
and would like to see it on the other end with:
netcat -lp 3002

To get started, that works when the netcat listening is done on the proxmox host console.
Then I added these rules:
iptables -t nat -A PREROUTING -p tcp -d --dport 3002 -i vmbr0 -j DNAT --to-destination

Now I'm not getting the test data on the proxmox host but I'm not getting it on the VM either. What am I doing wrong?
For anyone else running into this issue, I missed the forwarding entry since destination is on a different subnet. Anyway, this works

iptables -A PREROUTING -t nat -p tcp -i vmbr0 --dport 3002 -j DNAT --to-destination
iptables -A POSTROUTING -t nat -p tcp -d --dport 3002 -j MASQUERADE
iptables -A FORWARD -p tcp -d --dport 3002 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT


The Proxmox community has been around for many years and offers help and support for Proxmox VE, Proxmox Backup Server, and Proxmox Mail Gateway.
We think our community is one of the best thanks to people like you!

Get your subscription!

The Proxmox team works very hard to make sure you are running the best software and getting stable updates and security enhancements, as well as quick enterprise support. Tens of thousands of happy customers have a Proxmox subscription. Get yours easily in our online shop.

Buy now!