I have an application (mirth) on a server ( that on port 6661 is receiving an HL7 feed from an egate server from port 56789. For each message it receives/processes, its generating back an HL7 ACK message to port 56789. The egate server (which I don't control) isn't getting the ACK messages though, as its expecting to receive them at port 6661.

Would it be possible to setup iptables (on my mirth server -- that is to edit the ACK packets generated by mirth that were originally supposed to go to port 56789 and instead send them to port 6661?

I'm reading up on NAT/iptables ( http://www.karlrupp.net/en/computer/nat_tutorial ), but I'm not sure if its possible at this point and any help would be much appreciated.

Summary of fake IPs:

  • Mirth : (listening to port 6661)
  • Egate sender: (listening to port 56789)
  • Egate wants listening for ACKs: port 6661

3 Answers 3


You can use iptables with the --tcp-flags argument:

--tcp-flags [!] mask comp

Match when the TCP flags are as specified. The first argument is the flags which we should examine, written as a comma-separated list, and the second argument is a comma-separated list of flags which must be set. Flags are: SYN ACK FIN RST URG PSH ALL NONE. Hence the command

  iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN

will only match packets with the SYN flag set, and the ACK, FIN and RST flags unset.

I don't have a linux box handy to gin up the right incantation, but I'd think it would go something like:

iptables -t nat -A PREROUTING -p tcp --tcp-flags ACK ACK --dest --dport 56789 -j DNAT --to:destination

More or less your wanting to take advantage of the packet mangling feature of iptables. It involves altering the packets in the prerouting and postrouting tables. You also need to load a custom module when using this feature. I am in no way a pro at iptables, but have dealt with this in the past when I was alot younger. Heres a link to a document describing the process -

There is more on google about mangling packets. Sorry for not being more informative. I hope this help with conquest to take over the world.



I think this will work (though its not just filtering just ACKs and I am still testing.)

iptables -t nat -A OUTPUT -p tcp -d --dport 10000:65535 -j DNAT --to-destination
  • 2
    I don't believe you CAN filter just the (HL7) ACK (message) with iptables -- IPTables doesn't know the content. This solution redirects all the traffic which may break stuff. You'd really need something sitting in the middle that is HL7-aware to handle the message routing...
    – voretaq7
    Commented Aug 18, 2011 at 21:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .