I'm using this rule to configure SNAT:

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-source

I want to specify a rule to filter out packets not destined to the internal address and port that initiated the session. Additionally, for receiving packets from a specific external endpoint, it is necessary for the internal endpoint to send packets first to that specific external endpoint's IP address.(NAT Address Dependent Filtering)


A machine with internal IP and port (X:x) which is behind the NAT opens a connexion to a server with IP Y. So with the rule I must be able to allow only connexion coming from IP address Y and destined to (X:x). All other connexion will be droped.

1 Answer 1

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
iptables -P FORWARD -j DROP
iptables -A FORWARD -o eth1 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i eth1 -m state --state ESTABLISHED -j ACCEPT

What do these rules do?

  1. -A POSTROUTING -o eth1 -j MASQUERADE hides your internal IP's as packets leave your network
  2. -P FORWARD -j DROP sets the default policy for your FORWARD chain to DROP
  3. -A FORWARD -o eth1 -m state --state NEW,ESTABLISHED -j ACCEPT allows new and established FORWARDed connections out
  4. -A FORWARD -i eth1 -m state --state ESTABLISHED -j ACCEPT allows only established FORWARDed connections in

The rules above are assuming that you're using this box as a gateway/firewall with eth1 connected to your WAN and eth0 connected to your LAN.

Additional Reading: Postrouting and IP Masquerading


To configure "conditional" port forwarding:

By source port

iptables -A PREROUTING -t nat -i eth1 -p tcp --sport [trusted_source_port] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p tcp -d [internal_ip] --dport [internal_port] -j ACCEPT

By source IP

iptables -A PREROUTING -t nat -i eth1 -p tcp -s [trusted_source_ip] --dport [external_port] -j DNAT --to [internal_ip]:[internal_port]
iptables -A FORWARD -p tcp -d [internal_ip] --dport [internal_port] -j ACCEPT
  • Thanks for your reply. I think, for a session established from (X:x) to (Y:y), these rules allow only packets comming from IP address and port (Y:y). Isn't there a way to allow packets even with a different port number. I mean, allow machine Y to open new sessions to internal machine X.
    – HaTiMuX
    Jun 18, 2014 at 12:33
  • Have you tried this? The kernel maintains a list of all connections and it + TCP automagically manage IP/Port communication so you don't have to it manually. However, if you want to allow machine Y to establish new connections on internal machine X then you want to configure port forwarding. Is that correct?
    – Creek
    Jun 18, 2014 at 12:51
  • It's rather Port Triggering. It's similar to port forwarding but with additional conditions. According to my last example only machine Y will be allowed to establish new connexions to the internal machine X. We can say that the condition here is that machine X establishes a connexion to the external machine that will be allowed. I hope I was clear.
    – HaTiMuX
    Jun 18, 2014 at 13:17
  • I think the only way to do what I described is to get the IP destination Y for a session established from (X:x) to (Y:y) and then add this rule: #iptables -A PREROUTING -t nat -i eth0 -s IP –d X’ –dport x’ -j DNAT --to X:x with X' and x' the external IP and port affected by NAT. Then at the end of all sessions delete the defined rule. Now the problem is how to get the connection information.
    – HaTiMuX
    Jun 18, 2014 at 14:35
  • See my answer's update
    – Creek
    Jun 18, 2014 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .