I want to configure a NAT behavior different from the default one implemented by iptables.

In this example:

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source

The default behavior of NAT implemented by iptables is Endpoint independent. This means, all sessions initiated from the same host will have the same 'external' (IP, Port Number) even if there's a range of ports.

I need to know what are the flags or options to be modified in order to have a different port number for each session.

  • You want each outbound connection to have a different port number, correct? What makes you think your system isn't doing that already?
    – Creek
    Jun 17, 2014 at 12:59
  • I've already tested the rule by sinnifing packets and for 2 different sessions it's always the same port number that is affected.
    – HaTiMuX
    Jun 17, 2014 at 13:02
  • What does sudo iptables -vnL -t nat show?
    – Creek
    Jun 17, 2014 at 13:25
  • @HaTiMuX: How do you check "2 different sessions it's always the same port number"?
    – cuonglm
    Jun 17, 2014 at 13:26
  • @Creek for the specific rule it shows ... to: which means there is a port ranger. I think --random does the work.
    – HaTiMuX
    Jun 17, 2014 at 13:30

1 Answer 1


SNAT accepts a --random option (from iptables-extensions manpage):

       If  option --random is used then port mapping will be randomized
       (kernel >= 2.6.21).

So I'd try something like:

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source --random
  • Thanks, I've tried it and it's working for this specific case.
    – HaTiMuX
    Jun 18, 2014 at 8:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.