Mastodawn

It has been zero days since #iptables solved a problem I shouldn't have to solve. Specifically the #NETMAP target.

iptables -t mangle -A PREROUTING -s 192.0.2.0/24 -d 198.51.100.0/24 -i eth1 -j MARK --set-xmark 0xdeadbeef/0xffffffff

iptables -t nat -A PREROUTING -s 192.0.2.0/24 -d 198.51.100.0/24 -i eth1 -m mark --mark 0xdeadbeef -j NETMAP --to 192.0.2.0/24

iptables -t nat -A POSTROUTING -s 192.0.2.0/24 -d 192.0.2.0/24 -o eth1 -m mark --mark 0xdeadbeef -j NETMAP --to 198.51.100.0/24

#iptables' #NETMAP target can alter the source IP range exclusive or the destination IP range.

Which it does is dependent on where you use the NETMAP target.

If you use the NETMAP target in the PREROUTING chain of the mangle table, it alters the destination ip range.

If you use the NETMAP target in the POSTROUTING chain of the mangle table, it alters the source IP range.

#iptables' #NETMAP is functionally for IPv4 what network prefix translation (NPT) is for IPv6.