Iptables: Some questions!

1. In iptables, The SNAT Source Address can specify an IP segment, but the support for iprange is required.

 

// Change the package whose source address is 192.168.1.1-192.168.1.5 to 192.168.2.2iptables-T Nat-A postrouting-M iprange -- Src-range 192.168.1.1-192.168.1.5-j snat -- to-source 192.168.2.2

If not, you can only modify the source code so that it can identify the specified range symbol and resolve the IP addresses, such as-s 192.168.1.1-192.168.1.5 in itpables. the C xtables_ipparse_any () function is analyzed and parsed. The parameter is just a pointer to struct in_addr, And the pointer is used to obtain multiple analyzed IP addresses, you only need to analyze the range symbol "-" in the function to parse the IP address within a series of distributions referred to by the parameter saddrs (allocated within the function)

2. iptables is executed in the order of rules in the table...

For example, if the SNAT rule contains a masquerade before it is processed by the masquerade, SNAT may not process the subsequent package because the source address is modified by the masquerade rule and does not comply with the SNAT rule !!!

Post:

Iptables source code analysis
Http://bbs.chinaunix.net/thread-663849-1-1.html

Iptables Guide

Http://man.chinaunix.net/network/iptables-tutorial-cn-1.1.19.html#TABLE.SNATTARGET