Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good day.
I have a following issue - i have plenty of the computers in my local network(probably, about 40, and this amount could increase), and i want to give remote access to all of them from the internet. All those machines are connected to internal network through one gateway/firewall/whateverelse with debian 6.0.7 on board. I can do something like this with iptables on my debian gateway:

iptables -t nat -A PREROUTING -p tcp --dst %ip% -- dport 43001 -j DNAT --to-destination
iptables -t nat -A PREROUTING -p tcp --dst %ip% -- dport 43255 -j DNAT --to-destination

So, then the owner of machine will want to work from home, he will do it easily, and same for etc.
But how can i make same rules for all my local network? May be there is a way to do it just more elegant way then typing manually 255 iptables rules? May be there is some trick to dynamically resolve redirection, something like

-A PREROUTING -d %ip% -p tcp --dport 43%three-digits-number-var% -j DNAT --to-destination 192.168.0.%three-digits-number-var%

where %three-digits-number-var% is a variable from 0 to 255? I hope that somebody could help me or show me my mistakes, because i'm quite a new to networking and linux.

Upd. The main idea of my current configuration is that number of port matches local ip. E. g. port 43001 for, 43005 for and so on. So just specifying port range won't work. Or it would due to some voodoo?..

share|improve this question

With iptables you can specify a port range using

--dport 43000:43255

What I think you really need to do here is set up a VPN server so that your remote workers use that to connect to your office network.

share|improve this answer
I know nearly nothing about VPN. Am i able to setup it when, for example, my computer at home have "grey" ip? – Quadrat137 Mar 5 '13 at 8:22
One more thing. The DNAT target is only valid in the PREROUTING and OUTPUT chains. – RJS Mar 5 '13 at 8:27
Yeah, thanks. Edited that. That's really PREROUTING, i've mistakened. – Quadrat137 Mar 5 '13 at 8:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.