Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have been using ipfilter in the past. Here is what I used there:

map-block tun0 ->

Some remote applications require that multiple connections all come from the same IP address. So, I want to tell iptables to have a static mapping between IP address and use the same IP address for a host (i.e. use some magic to choose a port). How do I do this?

share|improve this question
up vote 1 down vote accepted

Use the iptables SNAT target with the persistent option to keep the IP chosen for a specific client the same:

iptables --table nat --append POSTROUTING --out-interface tun0 --source --jump SNAT --to-source --persistent

share|improve this answer

You can do similar with netfilter:

iptables -t nat -A POSTROUTING -o tun0 -s -j SNAT --to

You can read the iptables NAT howto here.

share|improve this answer

See iptables -j SNAT --to-source [ipaddr[-ipaddr]] --persistent

I don't know though "how static" this is. Maybe the mapping is lost on reboot. If that is a problem then you might configure a static mapping by an explicit rule for each address.

IIRC there is a tool (unfortunately I cannot remember the name) which can map source or destination addresses to chains so that you don't need a chain with 254 entries:

iptables ... -s -j ...
iptables ... -s -j ...
iptables ... -s -j ...
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.