Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 1 | This target is only valid in the |
| 2 | .B nat |
| 3 | table, in the |
| 4 | .B POSTROUTING |
| 5 | chain. It specifies that the source address of the packet should be |
| 6 | modified (and all future packets in this connection will also be |
| 7 | mangled), and rules should cease being examined. It takes one type |
| 8 | of option: |
| 9 | .TP |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 10 | \fB\-\-to\-source\fP \fIipaddr\fP[\fB\-\fP\fIipaddr\fP][\fB:\fP\fIport\fP[\fB\-\fP\fIport\fP]] |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 11 | which can specify a single new source IP address, an inclusive range |
| 12 | of IP addresses, and optionally, a port range (which is only valid if |
| 13 | the rule also specifies |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 14 | \fB\-p tcp\fP |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 15 | or |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 16 | \fB\-p udp\fP). |
Henrik Nordstrom | c279413 | 2004-01-22 15:04:24 +0000 | [diff] [blame] | 17 | If no port range is specified, then source ports below 512 will be |
| 18 | mapped to other ports below 512: those between 512 and 1023 inclusive |
| 19 | will be mapped to ports below 1024, and other ports will be mapped to |
Patrick McHardy | ef399a3 | 2007-05-29 11:24:45 +0000 | [diff] [blame] | 20 | 1024 or above. Where possible, no port alteration will |
| 21 | |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 22 | In Kernels up to 2.6.10, you can add several \-\-to\-source options. For those |
Harald Welte | a4749bc | 2005-08-29 12:50:20 +0000 | [diff] [blame] | 23 | kernels, if you specify more than one source address, either via an address |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 24 | range or multiple \-\-to\-source options, a simple round-robin (one after another |
Harald Welte | 599d2a1 | 2006-01-22 16:02:32 +0000 | [diff] [blame] | 25 | in cycle) takes place between these addresses. |
Harald Welte | a4749bc | 2005-08-29 12:50:20 +0000 | [diff] [blame] | 26 | Later Kernels (>= 2.6.11-rc1) don't have the ability to NAT to multiple ranges |
| 27 | anymore. |
Patrick McHardy | ef399a3 | 2007-05-29 11:24:45 +0000 | [diff] [blame] | 28 | .TP |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 29 | \fB\-\-random\fP |
Patrick McHardy | ef399a3 | 2007-05-29 11:24:45 +0000 | [diff] [blame] | 30 | If option |
Jan Engelhardt | fea74bf | 2009-01-12 04:53:18 +0100 | [diff] [blame] | 31 | \fB\-\-random\fP |
Patrick McHardy | ef399a3 | 2007-05-29 11:24:45 +0000 | [diff] [blame] | 32 | is used then port mapping will be randomized (kernel >= 2.6.21). |
| 33 | .RS |
| 34 | .PP |