Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on an iptables rule to apply after my shorewall script has initialized the firewall. I want a specific IP address ( in my lan to be redirected to unless it is going to paypal.

I have the following rule, and that works like a charm:

iptables -t nat -A PREROUTING ! -d -s -j DNAT --to

My problem is that paypal uses multiple ip addresses and I am not allowed to have multiple IP-addresses.

On top of this problem I would like to know how to remove the rule again, without having to restart shorewall.

Kind regards


share|improve this question

migrated from Oct 27 '09 at 19:23

This question came from our site for professional and enthusiast programmers.

This is more of a ServerFault question than a stackoverflow one. However you can delete rules from iptables with "iptables -t nat -D rulenumber" and there are iptables modules that allow you to match multiple IP addresses. If you don't have such a module you'll have to add several rules. Anyway you can find all answers in iptables excelent documentation. – Miguel Ventura Oct 27 '09 at 19:04

You probably want to use an HTTP proxy for this, not a firewall. A proxy can understand http, can see that the paypal domain is being requested, and can take appropriate action. For instance, privoxy is often used to change requests for images from advertising sites. You can chain different http proxies together, to combine the strengths of different kinds, or to make a "flowchart" of different reactions depending on request type.

share|improve this answer
+1. use the right tool for the job, it'll save a lot of headaches down the line when you find a website that uses ips that aren't in clear blocks, or every time paypal adds an IP your firewall breaks. – Sirex Sep 22 '11 at 7:52

I think you might be able to use the iprange module for something like this, I have used it for generic firewall rules before:

iptables -I RH-Firewall-1-INPUT 11 -m iprange --src-range -d -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

Errr... I take it back, I think you might want the --to-source or --to-destination with NAT,. You just put the range with a hypen, ie: --to-source . See the DNAT and SNAT sections of the iptables man page.

share|improve this answer
Don't know about shorewall though, sorry. – Kyle Brandt Oct 27 '09 at 19:41

I did some research and want to post the results.

I also found out I could do like so:

iptables -t nat -A PREROUTING -d -j ACCEPT
iptables -t nat -A PREROUTING -d -j ACCEPT
iptables -t nat -A PREROUTING ! -d -s -j DNAT --to

I can list the rules with:

iptables -t nat --line-numbers -n -L  PREROUTING

I can delete rules by:


Hope somebody finds this usefull :)

share|improve this answer
Is it not possible to specify the domain name you would want for Paypal? I know iptables works in some cases for this (iptables -A OUTPUT -p tcp --dport 80 -d -j DROP), so I'd imagine it works for other destination values as well. – Paul Kroon Jun 3 '10 at 0:54

Either way:

1) Schematically (not gonna check the syntax, so do your math):

iptables -t nat -A PREROUTING -s -j REDIRECT? -m comment --comment "should it be redirected?"

iptables -t nat -A REDIRECT? -d DST_IP1 -j RETURN -m comment --comment "nope"

iptables -t nat -A REDIRECT? -d DST_IP2 -j RETURN -m comment --comment "nope"

iptables -t nat -A REDIRECT? -d DST_IPn -j RETURN -m comment --comment "nope"

iptables -t nat -A REDIRECT? -j DNAT --to -m comment --comment "yep"

2) google up ipset

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.