Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to port forward with translation on a range of ports.

If I do:

iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 2000:3000 -j DNAT --to

it doesn't work as it should. If I connect to WANIP:2001 it tries to connect to instead that

Is there any way to do this without creating 1000 iptables rules?

share|improve this question
What do you need this for? – Zoredache Apr 14 '11 at 18:29
I need to make a router – drizzt Apr 14 '11 at 18:30
What? I am sorry, but that saying you want a router did not clear up things at all. Is there some reason why you can't just NAT everything to – Zoredache Apr 14 '11 at 18:34
because it's not a DMZ :) – drizzt Apr 14 '11 at 18:36
It's not working as you expected, but it's working as it should. NAT to a range will select any unused port in the range, and not do a 1-to-1 mapping. – pepoluan Apr 15 '11 at 0:15

There is no way to do range mapping like you are trying to do. You could write a 3 line script to generate the rules for you, but that would be a bad hack. I really think you are on the wrong track here. @Zoredache already tried to suggest this might not be the right solution at all. Please be more explicit with your situation so we can recommend something.

You probably do need some kind of NAT, but there are several kinds including full pass throughs that can route traffic over the full range of ports both directions to one machine, and other machines can tag along for one direction. Give us your architecture and we can suggest a proper solution. Setting up 1000 iptables rules isn't it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.