I think it is better to do it this way incase there are other rules that need to be traversed in the PREROUTING chain. iptables -t nat -N MS iptables -t nat -A MS -d 207.46.0.0/16 -j RETURN iptables -t nat -A MS -d 64,4,0,0/16 -j RETURN iptables -t nat -A MS -j DNAT --to-destination 10.1.1.3:80 iptables -t nat -A PREROUTING -j MS Regards, Abdul-Wahid On Thu, 23 Sep 2004 10:23:39 -0500, Aleksandar Milivojevic <amilivojevic@xxxxxx> wrote: > Jaret wrote: > > conceptually what im looking for is something like this... > > > > IPTABLES -t nat -A PREROUTING -s 10.1.1.2 -d ! 207.46.0.0/16, > > 64.4.0.0/16 --proto tcp --dport 80 -j DNAT --to-destination > > 10.1.1.3:80 > > You can try using user defined chain. Add source, protocol and port > options back into three PREROUTING rules, I left them out for clarity: > > iptables -t nat -N MS > iptables -t nat -A MS -j ACCEPT > iptables -t nat -A PREROUTING -d 207.46.0.0/16 -j MS > iptables -t nat -A PREROUTING -d 64.4.0.0/16 -j MS > iptables -t nat -A PREROUTING -j DNAT --to-destination 10.1.1.3:80 > > -- > Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited > Systems Administrator 1499 Buffalo Place > Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7 > >
