|
Packit |
7b22a4 |
This target is only valid in the
|
|
Packit |
7b22a4 |
.B nat
|
|
Packit |
7b22a4 |
table, in the
|
|
Packit |
7b22a4 |
.B POSTROUTING
|
|
Packit |
7b22a4 |
and
|
|
Packit |
7b22a4 |
.B INPUT
|
|
Packit |
7b22a4 |
chains, and user-defined chains which are only called from those
|
|
Packit |
7b22a4 |
chains. It specifies that the source address of the packet should be
|
|
Packit |
7b22a4 |
modified (and all future packets in this connection will also be
|
|
Packit |
7b22a4 |
mangled), and rules should cease being examined. It takes the
|
|
Packit |
7b22a4 |
following options:
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-to\-source\fP [\fIipaddr\fP[\fB\-\fP\fIipaddr\fP]][\fB:\fP\fIport\fP[\fB\-\fP\fIport\fP]]
|
|
Packit |
7b22a4 |
which can specify a single new source IP address, an inclusive range
|
|
Packit |
7b22a4 |
of IP addresses. Optionally a port range,
|
|
Packit |
7b22a4 |
if the rule also specifies one of the following protocols:
|
|
Packit |
7b22a4 |
\fBtcp\fP, \fBudp\fP, \fBdccp\fP or \fBsctp\fP.
|
|
Packit |
7b22a4 |
If no port range is specified, then source ports below 512 will be
|
|
Packit |
7b22a4 |
mapped to other ports below 512: those between 512 and 1023 inclusive
|
|
Packit |
7b22a4 |
will be mapped to ports below 1024, and other ports will be mapped to
|
|
Packit |
7b22a4 |
1024 or above. Where possible, no port alteration will occur.
|
|
Packit |
7b22a4 |
In Kernels up to 2.6.10, you can add several \-\-to\-source options. For those
|
|
Packit |
7b22a4 |
kernels, if you specify more than one source address, either via an address
|
|
Packit |
7b22a4 |
range or multiple \-\-to\-source options, a simple round-robin (one after another
|
|
Packit |
7b22a4 |
in cycle) takes place between these addresses.
|
|
Packit |
7b22a4 |
Later Kernels (>= 2.6.11-rc1) don't have the ability to NAT to multiple ranges
|
|
Packit |
7b22a4 |
anymore.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-random\fP
|
|
Packit |
7b22a4 |
If option
|
|
Packit |
7b22a4 |
\fB\-\-random\fP
|
|
Packit |
7b22a4 |
is used then port mapping will be randomized through a hash-based algorithm (kernel >= 2.6.21).
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-random-fully\fP
|
|
Packit |
7b22a4 |
If option
|
|
Packit |
7b22a4 |
\fB\-\-random-fully\fP
|
|
Packit |
7b22a4 |
is used then port mapping will be fully randomized through a PRNG (kernel >= 3.14).
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
\fB\-\-persistent\fP
|
|
Packit |
7b22a4 |
Gives a client the same source-/destination-address for each connection.
|
|
Packit |
7b22a4 |
This supersedes the SAME target. Support for persistent mappings is available
|
|
Packit |
7b22a4 |
from 2.6.29-rc2.
|
|
Packit |
7b22a4 |
.PP
|
|
Packit |
7b22a4 |
Kernels prior to 2.6.36-rc1 don't have the ability to
|
|
Packit |
7b22a4 |
.B SNAT
|
|
Packit |
7b22a4 |
in the
|
|
Packit |
7b22a4 |
.B INPUT
|
|
Packit |
7b22a4 |
chain.
|
|
Packit |
7b22a4 |
.TP
|
|
Packit |
7b22a4 |
IPv6 support available since Linux kernels >= 3.7.
|