Hi All,

I have a issue that the iptables rules not working in below case.
-A PORTFORWARD_NAT_CHAIN -i erouter0 -p tcp -m tcp --dport 2000:2005 -j DNAT --to-destination 192.168.0.20:4000-4005
-A PORTFORWARD_NAT_CHAIN -s 192.168.0.0/24 -d 10.4.2.119/32 -i l2sd0.2 -p tcp -m tcp --dport 2000:2005 -j DNAT --to-destination 192.168.0.20:4000-4005

=> Its current work as below (seem always maps to 4000 port)
10.4.2.119:2000 ==> 192.168.0.20:4000
10.4.2.119:2001 ==> 192.168.0.20:4000
...
10.4.2.119:2005 ==> 192.168.0.20:4000


I would expect below behavior

10.4.2.119:2000 ==> 192.168.0.20:4000
10.4.2.119:2001 ==> 192.168.0.20:4001
10.4.2.119:2002 ==> 192.168.0.20:4002
...
10.4.2.119:2005 ==> 192.168.0.20:4005


Somehow, the rules not have problem in below case


-A PORTFORWARD_NAT_CHAIN -i erouter0 -p tcp -m tcp --dport 2000:2005 -j DNAT --to-destination 192.168.0.20
-A PORTFORWARD_NAT_CHAIN -s 192.168.0.0/24 -d 10.4.2.119/32 -i l2sd0.2 -p tcp -m tcp --dport 2000:2005 -j DNAT --to-destination 192.168.0.20

10.4.2.119:2000 ==> 192.168.0.20:2000
...
10.4.2.119:2005 ==> 192.168.0.20:2005


Any comment or is this a linux iptables limiation? Thanks for your help!

Best Regards
James

If you are looking for a one-to-one port match then you are going to have to set up individual rules that way.
By stating a port range iptables is randomly going to pick one.

Your second example works like you want because you are only changing the IP Address not the port.

1 members found this post helpful.

Hi Layzdog,

Thanks for the response, so my understanding is current iptables doesn't support a single iptables rules for 1-1 mapping of port range to another IP port range.
I will try to check if there is any other solution other than using a single iptable rules.