Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a few port forward rules like this

iptables -t nat -A PREROUTING -p tcp --dport 46000 -j DNAT --to-destination
iptables -A FORWARD -p tcp -d --dport 46000 -j ACCEPT

I wonder if there is a way to add new forward rules in one line instead of two so I don't have to enter the same data twice. I mean rules like this:

  1. In nat PREROUTING forward packet to destination and mark it
  2. In filter FORWARD allow all packets that were marked using rule 1

Is it possible?

share|improve this question
up vote 1 down vote accepted

It is not possible to get this done with only one command per DNAT – unless... see below. But it is possible to enter the data just once.

Let's define the mark range 1024–2047 for connections which get DNATted and forwarded.

One line with each DNAT match condition in mangle:

iptables -t mangle -A PREROUTING -p tcp --dport 46000 -j MARK --set-mark 0x400
iptables -t mangle -A PREROUTING -p tcp --dport 46001 -j MARK --set-mark 0x401
iptables -t mangle -A PREROUTING -p tcp --dport 46002 -j MARK --set-mark 0x402

One command for each in nat:

iptables -t nat -A PREROUTING -m mark --mark 0x400 -j DNAT \
iptables -t nat -A PREROUTING -m mark --mark 0x401 -j DNAT \
iptables -t nat -A PREROUTING -m mark --mark 0x402 -j DNAT \

One command for all in filter:

iptables -A FORWARD -m mark --mark 0x400/0x400 -j ACCEPT

BTW: There is no need to give the destination port for -j DNAT if it is not changed.

Edit 1:

You can do that if you do without allowing the connections explicitly, if you are fine with allowing everything that has been DNATted. In that case you would stick to your

iptables -t nat -A PREROUTING -p tcp --dport 46000 -j DNAT --to-destination

but have only one FORWARD rule for all:

iptables -A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
share|improve this answer
That's still 2 commands for each port, one in mangle and one in nat – Poma Jun 7 '13 at 15:10
@Poma That's correct and when I realized that I was going to write a different answer ("It's not possible"). But then I also noticed that you did not only ask for a one command solution (which is impossible according to my understanding) but also for "not entering the data twice". And at least that is the case with my solution. – Hauke Laging Jun 7 '13 at 15:16
@Poma See the edit: There is a one command solution which is not equivalent but similar to your original rule set. – Hauke Laging Jun 7 '13 at 15:34
yes that's just what I need – Poma Jun 7 '13 at 15:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.