Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to add redirect rules for several thousand IP ranges but I am complete newbie when it comes to IP tables and want to make sure I got this right..

-t nat
-p tcp
-m iprange --src-range 111.222.333.64-111.222.333.140
--dport 25 -j REDIRECT --to 1025

If I understand correctly, that will forward any IP between 111.222.333.64 and 111.222.333.140 that was destined for port 25 to redirect instead to port 1025, is this correct?

share|improve this question
up vote 1 down vote accepted

You are right about what you said in regard to this rule, but there is one important thing that should be said.

Using REDIRECT, will redirect this type of traffic to the firewall machine itself not to the original destination IP address. If you want to change only the destination port (not the IP as well), you need to use DNAT target instead.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.