Manpage of IPTABLES
to see the list of valid TOS names.
MIRROR
This is an experimental demonstration target which inverts the source and destination fields in the IP
header and retransmits the packet. It is only valid in the INPUT, FORWARD and PREROUTING
chains, and user-defined chains which are only called from those chains. Note that the outgoing packets
are NOT seen by any packet filtering chains, connection tracking or NAT, to avoid loops and other
problems.
SNAT
This target is only valid in the nat table, in the POSTROUTING chain. It specifies that the source
address of the packet should be modified (and all future packets in this connection will also be mangled),
and rules should cease being examined. It takes one type of option:
--to-source ipaddr[-ipaddr][:port-port]
which can specify a single new source IP address, an inclusive range of IP addresses, and
optionally, a port range (which is only valid if the rule also specifies -p tcp or -p udp). If no port
range is specified, then source ports below 512 will be mapped to other ports below 512: those
between 512 and 1023 inclusive will be mapped to ports below 1024, and other ports will be
mapped to 1024 or above. Where possible, no port alteration will occur.
You can add several --to-source options. If you specify more
than one source address, either via an address range or multiple --to-source options, a simple round-
robin (one after another in cycle) takes place between these adresses.
DNAT
This target is only valid in the nat table, in the PREROUTING and OUTPUT chains, and user-defined
chains which are only called from those chains. It specifies that the destination address of the packet
should be modified (and all future packets in this connection will also be mangled), and rules should
cease being examined. It takes one type of option:
--to-destination ipaddr[-ipaddr][:port-port]
which can specify a single new destination IP address, an inclusive range of IP addresses, and
optionally, a port range (which is only valid if the rule also specifies -p tcp or -p udp). If no port
range is specified, then the destination port will never be modified.
http://www.iptablesrocks.org/syntax/man_iptables.htm (14 of 20) [2/13/2004 8:04:51 PM]
