I have a simple nat configuration to forward certain access to a gateway: iptables -t nat -A PREROUTING -p tcp -m set --match-set http_port dst,dst -j DNAT --to-destination XXX:80 iptables -t nat -A POSTROUTING -j MASQUERADE Can I do that without nat? Just trying to avoid the "conntrack table full" issue. Is there a non-stateful solution?