I am trying to transparently filter outbound SPAM from one of my hosting boxes. I have set up an external mail server that filters SPAM and now I am looking for a way to route all outbound SMTP traffic from the hosting server to the Mail Scanner with IPTables.

Eg. -- Outbound SMTP ( port 25) --> MailScanner ( port 2500)

So far my closest attempt has lead me to LAND attacks showing on our CISCO firewalls.

iptables -t nat -A POSTROUTING -o eth0 -p tcp -j SNAT --dport 2500 --to-source

I think you may consider where the outbound trafic are going to, it go from port 25 to ? you have to mach this trafic -and only this- and send it to

May be --sport 25 are enought.


Since you want to change the destination of the traffic, you need DNAT, not SNAT. You also need to match the specific packets you want to DNAT (i.e. destined for port 25).

iptables --table nat --append POSTROUTING --out-interface eth0 --protocol tcp --dport 25 --jump DNAT --to-destination

  • I think this is very close. However I get the following. ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT – Adrian Williams Feb 7 '13 at 21:22
  • For the locally generated traffic (which I believe is a case here) DNAT is performed in OUTPUT chain. – Tomek Nov 14 '20 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.