Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a server with 2 interfaces. a small netework connects to eth0 and gets out to internet on eth1. To allow 1 ip to nat I use

iptables -t nat -A POSTROUTING -o eth1 -s -j SNAT --to-source=23.x.x.x

I would like to add a rule that allow a single ip do nat and block the others already existing in iptables(without deleting them)

iptables -t nat -A POSTROUTING -o OUT_IF \! -s ip_sursa -j SNAT -j DROP

would work?

Or, to allow only 1 ip to pass over eth0 to eth1 and do nat.

share|improve this question

It is not recommended to use DROP in the NAT table. It is better to do this the filter table if you want to deny the access to these IP addresses.

Otherwise, you can use a different rule to NAT these IPs to a different public IP.


Here are the rules you need to allow only one IP (

iptables -A FORWARD -o eth1 -s -j ACCEPT
iptables -A FORWARD -o eth1 -s -j DROP
iptables -t nat -A POSTROUTING -o eth1 -s -j SNAT --to-source=23.x.x.x
share|improve this answer can I do it? How to allow only 1 ip pass from eth0 to eth1? – Linux_begnr Jul 16 '11 at 11:53
You can use iptables -A FORWARD -o OUT_IF -s IP_range -j DROP. – Khaled Jul 16 '11 at 14:35
the ip i want to allow is I want to block all the others.How to give the range from 0-99 and 101-254(with i will block all class). can i give IP_range= and and make 2 rules? – Linux_begnr Jul 16 '11 at 16:43
"iptables -A FORWARD -o OUT_IF -s IP_range -j DROP" without "-t nat"?I need nat – Linux_begnr Jul 16 '11 at 17:37
iptables -A FORWARD -o OUT_IF -m iprange --src-range -j DROP and iptables -A FORWARD -o OUT_IF -m iprange --src-range -j DROP would work? – Linux_begnr Jul 17 '11 at 10:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.