Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an existing iptables setup that does port forwarding. In this port forwarding scenario there are some instances where I do not want it to port forward. So, for instance I have this defined:

iptables -A PREROUTING -t nat -i eth0 '!' -s -p tcp --dport 80 -j DNAT --to

This will prevent 10.200/16 from accessing this rule. As it turns out, I need to add multiple exclusions. However, there does not seem to be a way to do this:

iptables -A PREROUTING -t nat -i eth0 '!' -s, -p tcp --dport 8080 -j DNAT --to
iptables v1.4.8: ! not allowed with multiple source or destination IP addresses

I'm going to assume I have to approach this differently, but I do not know how. Any suggestions?

share|improve this question
Can you not add a rule that DROP's based on a positive match of the criteria earlier in the chain? – Bratchley Apr 2 '13 at 18:50
Not to mix words.. but I don't want to literally "drop" anything. The packet still needs to be managed by the firewall. A packet could come from the internet (follow NAT rules), or from an ipsec connection (do not follow NAT rules) – jagauthier Apr 2 '13 at 19:10

You could use one of the following variants:

First one is ipset with set type "hash:net".

Second one is a iptables rule chain with -j RETURN for each network to skip check, and the desired default action as the last chain rule.

Third one is to mark packet with some bit flag using -j MARK and corresponding flag playing (with --set-mark, --set-xmark, etc.), and then to do the desired action if mark check is satisfied (-m mark and --mark). This is the most generic variant, because mark could be set in one table and checked in another one. OTOH the mark bitmask is limited to 32 bits, that could be not enough for complex rules.

share|improve this answer
Thanks. I looked into -j RETURN, but I couldn't figure out how to apply it. – jagauthier Apr 2 '13 at 19:28
-j RETURN.... GENIUS! – Davide Berra Jul 31 '13 at 11:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.