In iptables, what is the difference between targets DNAT and REDIRECT?

Question

More specifically, is

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT

equivalent to one or both of these?

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination :$NEWPORT
-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination $IP_OF_INT:$NEWPORT

Solution

According to netfilter documentation, redirection is a specialized case of destination NAT. REDIRECT is equivalent to doing DNAT to the incoming interface.

Linux 2.4 NAT HOWTO -- Destination NAT

So it means the first and second strings are equivalent.

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j REDIRECT --to-ports $NEWPORT
-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination :$NEWPORT

The string:

-A PREROUTING -i $INT -p $PROTO --dport $PORT -j DNAT --to-destination $IP_OF_INT:$NEWPORT

does the same job only if $IP_OF_INT - is the IP address on the incoming interface (IP of $INT).

Comments

[Clare]

That link is very helpful, thank you. Just so that I can be 100% sure for future reference, could you please quote the strings that you mean when you say 'first and second'?

[Clare]

Awesome, thanks! Your edits really cleared things up for me, I feel significantly more sure of what I'm doing now.