Technical data

3. Base conﬁguration

Action chain(s) Meaning

DNAT PREROUTING Replace destination address and destination

port of the packet by the address speciﬁed as a

parameter for SNAT (for all packets belonging

to the connection in consideration).

REDIRECT PREROUTING

OUTPUT

Replace destination port of the packet by the

address speciﬁed as a parameter for SNAT (for

all packets belonging to the connection in con-

sideration).

NETMAP PREROUTING

POSTROUTING

Copy destination resp. source address of the

packet to the range speciﬁed as a parameter

for NETMAP; the ports stay unchanged (for all

packets belonging to the connection in consid-

eration; while changing the destination address

in the PREROUTING-chain and the source address

of the POSTROUTING-chain).

Table 3.5.: Packet Filter Actions

Some of these actions may be modiﬁed in behaviour by using the options BIDIRECTIONAL,

LOG or NOLOG. BIDIRECTIONAL generates the same rule a second time with source and destina-

tion adresse exchanged (and source and destination port exchanged and/or in- and outbound

network interface exchanged if speciﬁed). LOG/NOLOG activates resp. deactivates logging for

this rule.

3.10.2. Restrictions For Rules

Restrictions may be deﬁned by constraints explained in the following sections. You may use any

at any place where you don’t want restrictions but want/have to specify something. Constraints

can be speciﬁed in any order if they have a preceding preﬁx. This applies to all restrictions,

except for specifying a source or destination address which must always be placed directly in

front of the action, other constraints must be speciﬁed before. Restrictions can also be negated,

simply preﬁx them by a !.

Constraints For Source And Target

Each packet contains source and target informations in a tuple of an IP address and ports.

This source resp. target can serve as a constraint and may be addressed like this:

Expression Meaning

ip a simple IP address

network a network declaration in the form of

A port only exists for TCP- and UDP-packets.