6

More specifically, is 

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT

equivalent to one or both of these? 

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination :$NEWPORT
-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination $IP_OF_INT:$NEWPORT
Improve this question

1 Answer 1

Reset to default
6

According to netfilter documentation, redirection is a specialized case of destination NAT. REDIRECT is equivalent to doing DNAT to the incoming interface.

Linux 2.4 NAT HOWTO -- Destination NAT

So it means the first and second strings are equivalent.

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT
-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination :$NEWPORT

The string:

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination $IP_OF_INT:$NEWPORT

does the same job only if $IP_OF_INT - is the IP address on the incoming interface (IP of $INT).

Improve this answer
2
  • That link is very helpful, thank you. Just so that I can be 100% sure for future reference, could you please quote the strings that you mean when you say 'first and second'?
    – Clare
    Commented Jul 14, 2014 at 17:57
  • Awesome, thanks! Your edits really cleared things up for me, I feel significantly more sure of what I'm doing now.
    – Clare
    Commented Jul 14, 2014 at 18:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .