Re: port redirection *without* nat

[Joel Newkirk <netfilter@newkirk.us>]

On Monday 06 January 2003 02:17 pm, sm@rhythm.cx wrote:
> I'm trying to figure out how (if possible) to do port redirection with
> iptables on my linux router. This router is is not doing NAT, all
> connected networks have real, public IP addresses. There is tons of
> information out there about doing port redirection with NAT, but I
> can't find anything for without NAT. I just want to make the router
> take traffic destined for address A port x and change the destination
> address to send it off to address B port x instead. A and B are on the
> same (directly attached ethernet) network. I looked into the DNAT and
> REDIRECT targets, but those only seem to work in the nat table.

What you say you are trying to do IS DNAT.  A packet reaches the machine 
addressed to one destination, but you want to send it to another address 
instead, changing the Destination IP.  Destination NAT.  And yes, such 
targets only work in the nat table's chains, and for DNAT you want to 
use the PREROUTING chain.  The REDIRECT target is for picking traffic 
out of the stream that would normally be forwarded and DNATting it to 
readdress it to the local box as INPUT instead.  

The most frequently mentioned use of DNAT is for packets addressed to an 
IP of the box itself, but this isn't necessary.  DNAT is simply changing 
the destination IP, regardless of what it originally was. 

j