1

I want to configure a NAT behavior different from the default one implemented by iptables.

In this example:

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 193.49.142.107:2000-400

The default behavior of NAT implemented by iptables is Endpoint independent. This means, all sessions initiated from the same host will have the same 'external' (IP, Port Number) even if there's a range of ports.

I need to know what are the flags or options to be modified in order to have a different port number for each session.

6
  • You want each outbound connection to have a different port number, correct? What makes you think your system isn't doing that already?
    – Creek
    Jun 17 '14 at 12:59
  • I've already tested the rule by sinnifing packets and for 2 different sessions it's always the same port number that is affected.
    – HaTiMuX
    Jun 17 '14 at 13:02
  • What does sudo iptables -vnL -t nat show?
    – Creek
    Jun 17 '14 at 13:25
  • @HaTiMuX: How do you check "2 different sessions it's always the same port number"?
    – cuonglm
    Jun 17 '14 at 13:26
  • @Creek for the specific rule it shows ... to:175.45.14.88:90-100 which means there is a port ranger. I think --random does the work.
    – HaTiMuX
    Jun 17 '14 at 13:30
3

SNAT accepts a --random option (from iptables-extensions manpage):

--random
       If  option --random is used then port mapping will be randomized
       (kernel >= 2.6.21).

So I'd try something like:

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source 193.49.142.107:2000-4000 --random
1
  • Thanks, I've tried it and it's working for this specific case.
    – HaTiMuX
    Jun 18 '14 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.