Re: How to mangle source packet source ports to a fixed range

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Steve a écrit :
> I have a need to set the source packet's high (unprivileged) source ports to a 
> fixed range of high  ports on a firewall providing NAT.

NAT = source NAT (or masquerading) ?

> The goal is to be able to identify the inside machines at the destination 
> after NAT has changed the addresses.  This is for identification only.  I do 
> not need to connect back to the machines inside the firewall.  I realize this 
> may break certain protocols which may use dedicated unprivileged ports.
> 
> i.e.:
> 
> PREROUTING -i eth0 -p tcp -m tcp -s 192.168.0.x  --sport 1024:65535 -j 
> REDIRECT --to-ports 2000-2200
> 
> The above modifies the destination port based on the source port.

Not only it modifies the destination port but also the destination address.

>  I wish to modify the source port (  --from-ports ? ).

POSTROUTING [...] -j SNAT --to-source [ipaddr[-ipaddr]]:port-port
or
POSTROUTING [...] -j MASQUERADE --to-ports port-port