3

More specifically, is

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT

equivalent to one or both of these?

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination :$NEWPORT
-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination $IP_OF_INT:$NEWPORT
4

According to netfilter documentation, redirection is a specialized case of destination NAT. REDIRECT is equivalent to doing DNAT to the incoming interface.

Linux 2.4 NAT HOWTO -- Destination NAT

So it means the first and second strings are equivalent.

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT
-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination :$NEWPORT

The string:

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination $IP_OF_INT:$NEWPORT

does the same job only if $IP_OF_INT - is the IP address on the incoming interface (IP of $INT).

  • That link is very helpful, thank you. Just so that I can be 100% sure for future reference, could you please quote the strings that you mean when you say 'first and second'? – Clare Jul 14 '14 at 17:57
  • Awesome, thanks! Your edits really cleared things up for me, I feel significantly more sure of what I'm doing now. – Clare Jul 14 '14 at 18:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.