FM / html

/usr/share/doc/iptables/html

Name	Size	Mode	Actions
NAT-HOWTO-1.html	1152	0644	edit dl rm
NAT-HOWTO-2.html	4346	0644	edit dl rm
NAT-HOWTO-3.html	1444	0644	edit dl rm
NAT-HOWTO-4.html	4400	0644	edit dl rm
NAT-HOWTO-5.html	5139	0644	edit dl rm
NAT-HOWTO-6.html	8397	0644	edit dl rm
NAT-HOWTO-7.html	1324	0644	edit dl rm
NAT-HOWTO-8.html	1136	0644	edit dl rm
NAT-HOWTO-9.html	2091	0644	edit dl rm
NAT-HOWTO-10.html	2525	0644	edit dl rm
NAT-HOWTO-11.html	910	0644	edit dl rm
NAT-HOWTO.html	2666	0644	edit dl rm
netfilter-extensions-HOWTO-1.html	2102	0644	edit dl rm
netfilter-extensions-HOWTO-2.html	7807	0644	edit dl rm
netfilter-extensions-HOWTO-3.html	28969	0644	edit dl rm
netfilter-extensions-HOWTO-4.html	12548	0644	edit dl rm
netfilter-extensions-HOWTO-5.html	7041	0644	edit dl rm
netfilter-extensions-HOWTO-6.html	11242	0644	edit dl rm
netfilter-extensions-HOWTO-7.html	2188	0644	edit dl rm
netfilter-extensions-HOWTO-8.html	1021	0644	edit dl rm
netfilter-extensions-HOWTO-9.html	2222	0644	edit dl rm
netfilter-extensions-HOWTO.html	7267	0644	edit dl rm
netfilter-hacking-HOWTO-1.html	7474	0644	edit dl rm
netfilter-hacking-HOWTO-2.html	1718	0644	edit dl rm
netfilter-hacking-HOWTO-3.html	8038	0644	edit dl rm
netfilter-hacking-HOWTO-4.html	53338	0644	edit dl rm
netfilter-hacking-HOWTO-5.html	1056	0644	edit dl rm
netfilter-hacking-HOWTO-6.html	3028	0644	edit dl rm
netfilter-hacking-HOWTO-7.html	9288	0644	edit dl rm
netfilter-hacking-HOWTO-8.html	5234	0644	edit dl rm
netfilter-hacking-HOWTO-9.html	835	0644	edit dl rm
netfilter-hacking-HOWTO.html	3811	0644	edit dl rm
packet-filtering-HOWTO-1.html	1891	0644	edit dl rm
packet-filtering-HOWTO-2.html	1593	0644	edit dl rm
packet-filtering-HOWTO-3.html	5775	0644	edit dl rm
packet-filtering-HOWTO-4.html	2189	0644	edit dl rm
packet-filtering-HOWTO-5.html	1644	0644	edit dl rm
packet-filtering-HOWTO-6.html	3505	0644	edit dl rm
packet-filtering-HOWTO-7.html	35616	0644	edit dl rm
packet-filtering-HOWTO-8.html	1457	0644	edit dl rm
packet-filtering-HOWTO-9.html	2333	0644	edit dl rm
packet-filtering-HOWTO-10.html	2575	0644	edit dl rm
packet-filtering-HOWTO-11.html	3742	0644	edit dl rm
packet-filtering-HOWTO.html	2831	0644	edit dl rm

Edit: /usr/share/doc/iptables/html/NAT-HOWTO-5.html (5139B)

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<HTML>
<HEAD>
 <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.82">
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <TITLE>Linux 2.4 NAT HOWTO: Controlling What To NAT</TITLE>
 <LINK HREF="NAT-HOWTO-6.html" REL=next>
 <LINK HREF="NAT-HOWTO-4.html" REL=previous>
 <LINK HREF="NAT-HOWTO.html#toc5" REL=contents>
</HEAD>
<BODY>
<A HREF="NAT-HOWTO-6.html">Next</A>
<A HREF="NAT-HOWTO-4.html">Previous</A>
<A HREF="NAT-HOWTO.html#toc5">Contents</A>
<HR>
<H2><A NAME="s5">5.</A> <A HREF="NAT-HOWTO.html#toc5">Controlling What To NAT</A></H2>

<P>You need to create NAT rules which tell the kernel what connections
to change, and how to change them.  To do this, we use the very
versatile <CODE>iptables</CODE> tool, and tell it to alter the NAT table by
specifying the `-t nat' option.</P>

<P>The table of NAT rules contains three lists called `chains': each
rule is examined in order until one matches.  The two chains are
called PREROUTING (for Destination NAT, as packets first come in), and
POSTROUTING (for Source NAT, as packets leave).  The third (OUTPUT)
will be ignored here.</P>

<P>The following diagram would illustrate it quite well if I had any
artistic talent:</P>
<P>
<BLOCKQUOTE><CODE>
<PRE>
      _____                                     _____
     /     \                                   /     \
   PREROUTING -->[Routing ]----------------->POSTROUTING----->
     \D-NAT/     [Decision]                    \S-NAT/
                     |                            ^
                     |                            |
                     |                            |
                     |                            |
                     |                            |
                     |                            |
                     |                            |
                     --------> Local Process ------
</PRE>
</CODE></BLOCKQUOTE>
</P>
<P>At each of the points above, when a packet passes we look up what
connection it is associated with.  If it's a new connection, we look
up the corresponding chain in the NAT table to see what to do with it.
The answer it gives will apply to all future packets on that
connection.</P>

<H2><A NAME="ss5.1">5.1</A> <A HREF="NAT-HOWTO.html#toc5.1">Simple Selection using iptables</A>
</H2>

<P><CODE>iptables</CODE> takes a number of standard options as listed
below.  All the double-dash options can be abbreviated, as long as
<CODE>iptables</CODE> can still tell them apart from the other possible
options.  If your kernel has iptables support as a module, you'll need
to load the ip_tables.o module first: `insmod ip_tables'.</P>

<P>The most important option here is the table selection option, `-t'.
For all NAT operations, you will want to use `-t nat' for the NAT
table.  The second most important option to use is `-A' to append a
new rule at the end of the chain (e.g. `-A POSTROUTING'), or `-I' to
insert one at the beginning (e.g. `-I PREROUTING').</P>

<P>You can specify the source (`-s' or `--source') and destination
(`-d' or `--destination') of the packets you want to NAT.  These
options can be followed by a single IP address (e.g. 192.168.1.1), a
name (e.g. www.gnumonks.org), or a network address
(e.g. 192.168.1.0/24 or 192.168.1.0/255.255.255.0).</P>

<P>You can specify the incoming (`-i' or `--in-interface') or outgoing
(`-o' or `--out-interface') interface to match, but which you can
specify depends on which chain you are putting the rule into: at
PREROUTING you can only select incoming interface, and at POSTROUTING
you can only select outgoing interface.  If you use the
wrong one, <CODE>iptables</CODE> will give an error.</P>

<H2><A NAME="ss5.2">5.2</A> <A HREF="NAT-HOWTO.html#toc5.2">Finer Points Of Selecting What Packets To Mangle</A>
</H2>

<P>I said above that you can specify a source and destination address.
If you omit the source address option, then any source address will
do.  If you omit the destination address option, then any destination
address will do.</P>

<P>You can also indicate a specific protocol (`-p' or `--protocol'),
such as TCP or UDP; only packets of this protocol will match the rule.
The main reason for doing this is that specifying a protocol of tcp or
udp then allows extra options: specifically the `--source-port' and
`--destination-port' options (abbreviated as `--sport' and `--dport').</P>

<P>These options allow you to specify that only packets with a certain
source and destination port will match the rule.  This is useful for
redirecting web requests (TCP port 80 or 8080) and leaving other
packets alone.</P>

<P>These options must follow the `-p' option (which has a side-effect
of loading the shared library extension for that protocol).  You can
use port numbers, or a name from the /etc/services file.</P>

<P>All the different qualities you can select a packet by are detailed
in painful detail in the manual page (<CODE>man iptables</CODE>).</P>

<HR>
<A HREF="NAT-HOWTO-6.html">Next</A>
<A HREF="NAT-HOWTO-4.html">Previous</A>
<A HREF="NAT-HOWTO.html#toc5">Contents</A>
</BODY>
</HTML>

cmd: