On Tue, May 16, 2023, at 07:07, Shane Wang wrote: > Thanks for your reply. > > I think the "--to-destination 10.0.0.1" rule will be matched, and the > "--to-destination 10.0.0.2" rule will never be matched. > Does iptables unsupported "full cone" NAT for multiple internal IP addresses? Does *any* platform support such a configuration? Based on my understanding of what 'full cone' means, every internal address needs a separate external address to be fully mapped to it. Your example shows that you have one external address, which means you can only provide 'full cone' mapping for one internal address, no matter which tool you use.
