I need to port forward with translation on a range of ports.

If I do:

iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 2000:3000 -j DNAT --to

it doesn't work as it should. If I connect to WANIP:2001 it tries to connect to instead that

Is there any way to do this without creating 1000 iptables rules?

  • What do you need this for? – Zoredache Apr 14 '11 at 18:29
  • I need to make a router – drizzt Apr 14 '11 at 18:30
  • What? I am sorry, but that saying you want a router did not clear up things at all. Is there some reason why you can't just NAT everything to – Zoredache Apr 14 '11 at 18:34
  • because it's not a DMZ :) – drizzt Apr 14 '11 at 18:36
  • It's not working as you expected, but it's working as it should. NAT to a range will select any unused port in the range, and not do a 1-to-1 mapping. – pepoluan Apr 15 '11 at 0:15

There is no way to do range mapping like you are trying to do. You could write a 3 line script to generate the rules for you, but that would be a bad hack. I really think you are on the wrong track here. @Zoredache already tried to suggest this might not be the right solution at all. Please be more explicit with your situation so we can recommend something.

You probably do need some kind of NAT, but there are several kinds including full pass throughs that can route traffic over the full range of ports both directions to one machine, and other machines can tag along for one direction. Give us your architecture and we can suggest a proper solution. Setting up 1000 iptables rules isn't it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.