Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

At anytime I have about 3-4 VZ containers on a server(the Hardware Node on CentOS6). I have webservers, ssh, mail, etc running on the different Containers. From another host in the network, they are accessed as ip.of.hardware.node:port and iptables forwards them with a rule in the nat table.

To explain what I really want:
Assume my Container IDs are 2, 3, 4. And their IPs respectively are,,
I want a setup where in if anyone accesses ip.of.hardware.node:2080, the connection should be forwarded to
ip.of.hardware.node:2022 => (ContainerID: 2)
ip.of.hardware.node:3022 => (ContainerID: 3)
ip.of.hardware.node:4080 => (ContainerID: 4)
ip.of.hardware.node:4443 => (ContainerID: 4)
... and so on.

This way, each Container gets a block of 1000 ports to work in. Is there a way to achieve this without specifying 1000 rules for each Container?

share|improve this question

On the hardware node, you would need to create an IPtables DNAT rule for each forwarded service you want.

Using your example scenario:

iptables -t nat -A PREROUTING -p tcp --dport 2022 -i eth0 -j DNAT --to-destination
iptables -t nat -A PREROUTING -p tcp --dport 3022 -i eth0 -j DNAT --to-destination
iptables -t nat -A PREROUTING -p tcp --dport 4080 -i eth0 -j DNAT --to-destination
iptables -t nat -A PREROUTING -p tcp --dport 4443 -i eth0 -j DNAT --to-destination

If you plan on deploying many more containers and services, you could script the creation of these rules based on your port conventions.

share|improve this answer
Yes, this is what currently exists, but I want to forward all of 1000 ports. And a thousand rules are not desirable, or practical. So I just wanted to know if there is anyway with a manageable number of rules to forward all of 1000 ports. Anyways, I'm down to writing a module and hoping it works. – kumar Nov 5 '12 at 6:08

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.