lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Wed, 25 Jan 2012 17:52:07 +0100
From:	Eric Dumazet <>
Cc:	Linux Kernel Network Developers <>
Subject: Re: NAT question

Le mercredi 25 janvier 2012 à 10:54 -0500, Stephen Clark a écrit :
> Can iptables do a network to network nat without having to write out a 
> bunch of nat rules.
> In other words translate to without 
> having to write out
> 256 rules.
> Also can iptables handle 1000 nat rules like above if they have to be 
> written out on
> a 1.66ghz intel dual core atom with 1gb of mem.
> I know this isn't appropriate question for devel list but I didn't find 
> anything googling.
> Thanks,

If you are forced to use 256 rules, you could split them into 16 tables
of 16 rules and do a hash split.

Since these rules are run only for new connections, it might be OK
performance wise, depending on rate of connection establishment.

If not, you can try NETMAP :)

# iptables -t nat -A POSTROUTING -s -j NETMAP --to

# iptables -t nat -nvL POSTROUTING
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 NETMAP     all  --  *      * 

To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to
More majordomo info at

Powered by blists - more mailing lists