DNAT port range with different internal port range with Iptables
To answer your question, yes.
I ran a sample rule on my Debian box...
iptables -t nat -A PREROUTING -i xenbr0 -p tcp --dport 64000:65000 -j DNAT --to 172.16.10.10:61000-62000
... which produced no output, indicating success. I'm running kernel 3.16.0-4-amd64
.
Checking the NAT rule via iptables -t nat -vnL PREROUTING
, I see the rule is listed...
DNAT tcp -- xenbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpts:64000:65000 to:172.16.10.10:61000-62000
MadHatter is correct, you do not need -m multiport
for port ranges, only for comma-separated lists of ports. The :
is needed in order to specify port ranges for the --dport
option, but a -
is needed in order to specify port ranges in the DNAT
target.
How well this rule will work in practice I cannot say, but theoretically it should accomplish your goal.
More information on DNAT
target can be found here.
Hope this helps.