I need to connect a client machine over the internet to my terminal server. Setup below |client|-----|internet|----|linux iptables filter|----|hub|----|win2k terminal server| can someone help me with the relevent rules for iptables to get this to work. I have the following rules in place but cant get the client machine to connect. "iptables -t nat -A PREROUTING -i ippp0 -p tcp --dport 3389 -j DNAT --to-destination 10.0.0.4" and a forward rule. I hope someone can help me. Thanks in advance. Ian

Ian, this is my rule that works for me, iptables -t nat -A PREROUTING -i ppp0 -p tcp -d $EXTIP --dport 3389 -j DNAT --to-destination 192.168.0.100:3389 let me know how it goes or if you have any other questions. trav.

The line that trav has sugggested will work, but if the remote client has a static IP (or you know that it will be assigned a range of specific IPs), it might be more secure to limit access to machines with just one or a small range of addresses: iptables -t nat -A PREROUTING -i ppp0 -p tcp -s $TRUSTEDIP -d $EXTIP --dport 3389 -j DNAT --to-destination 192.168.0.100:3389 ...where 'TRUSTEDIP' is the address of the remote machine allowed in (eg: TRUSTEDIP="203.34.12.67"). Cheers, Bill