2

What does every part of this command mean?

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
8
  • 6
    It means you should read man sudo and man iptables
    – waltinator
    Nov 8, 2016 at 15:50
  • 3
    Why so many downvotes?!
    – TheOdd
    Nov 8, 2016 at 16:09
  • 2
    Don't know! looks like people are not in good mode at this morning lol
    – Alex9766
    Nov 8, 2016 at 16:16
  • 1
    This is a very basic question with the answer very easily in reach. He could have simply googled a couple commands for his answer and then asked a valid question if he didn't understand something. The answers are snippets from man pages.
    – user508889
    Nov 8, 2016 at 16:20
  • 1
    Yeah, I prefer the other one @bc2946088 :)
    – Zanna
    Nov 8, 2016 at 18:13

2 Answers 2

6

From the manual pages of iptables(8):

iptables:

Iptables and ip6tables are used to set up, maintain, and inspect the tables of IPv4 and IPv6 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.

-t nat:

Iptables and ip6tables are used to set up, maintain, and inspect the tables of IPv4 and IPv6 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.

This table is consulted when a packet that creates a new connection is encountered. It consists of three built-ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about to go out). IPv6 NAT support is available since kernel 3.7.

-A POSTROUTING:

Append one or more rules to the end of the selected chain. When the source and/or destination names resolve to more than one address, a rule will be added for each possible address combination.

-o eth0: (eth0 is:)

Name of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains). When the "!" argument is used before the interface name, the sense is inverted. If the interface name ends in a "+", then any interface which begins with this name will match. If this option is omitted, any interface name will match.

-j MASQUERADE:

This specifies the target of the rule; i.e., what to do if the packet matches it. The target can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension (see EXTENSIONS below). If this option is omitted in a rule (and -g is not used), then matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.

1
5

sudo: It stands for “super user do!” as a Linux system administrator or power user, it’s one of the most important commands.

iptables: Is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel.

-t: This option specifies the packet matching table which the command should operate on.

nat: This table is consulted when a packet that creates a new connection is encountered.

-A: Append one or more rules to the end of the selected chain.

POSTROUTING: One of three built-ins of nat, for altering packets as they are about to go out.

-o eth0: Name of an interface via which a packet is going to be sent.

-j MASQUERADE : This specifies the target of the rule; i.e., what to do if the packet matches it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .