Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have this iptables and working.

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 0:20 -j REDIRECT --to-port 8080 #bypass SSH
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 23:442 -j REDIRECT --to-port 8080 #bypass SSL
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 444:2082 -j REDIRECT --to-port 8080 #Cpanel SSL
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 2084:2086 -j REDIRECT --to-port 8080 #WHM SSL

any idea to change this into following condition in more simple rules:

Redirect ALL traffic to 8080

and Exclude Redirection if destination port match 22,443,2083 and 2087

thank you.


Multiports support up to 15 separate port Ref: Iptables packet filtering notes

so, i used another method to directly accept defined ports for example whois (port43)

iptables -t nat -A PREROUTING -i eth0  -p tcp -m multiport \
--dports 43 \
share|improve this question
up vote 3 down vote accepted

One might argue this might work as an effort to concise your rules but it will not work as expected.

iptables -t nat -A PREROUTING -i eth0  -p tcp -m multiport --dports ! 22,443,2083,2087 -j REDIRECT --to-port 8080

the condition "-option a,b" is equivalent to "-option a OR -option b" which is exactly the 4 rules generated from the single one. However if "! -option a,b" is to be interpreted as "NOT (-option a OR -option b)", that is actually "(NOT -option a) AND (NOT -option b)" which just cannot be exploded into two rules.

share|improve this answer
will try later. right now not able to test. thank you. – apis17 Feb 1 '12 at 2:59
what is maximum number of --dports ! can we assign? – apis17 Feb 2 '12 at 4:00
There should be no limit but i am not sure though – kaji Feb 2 '12 at 14:11
this is very cute. single line and all done. thank you. – apis17 Feb 2 '12 at 23:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.