Port IP Address Redirection

Home · Start Here · Reference Map

At a glance

• DNAT redirects traffic from one IP to another; REDIRECT remaps ports on the same host.
• Rules are defined in /etc/csf/csf.redirect, one entry per line.
• Requires NAT tables and specific iptables modules (ipt_DNAT, ipt_SNAT, ipt_REDIRECT).
• Not intended for general routing, NAT gateways, or VPN use cases.

Related guide: Configuration-Guide

Prerequisites

• Kernel NAT table support enabled.
• Required iptables modules loaded:
  • ipt_DNAT
  • ipt_SNAT
  • ipt_REDIRECT
• For DNAT (cross-IP) redirections: IP forwarding must be enabled:

cat /proc/sys/net/ipv4/ip_forward
# Must return 1

CSF attempts to set ip_forward = 1 automatically when DNAT rules are present, but if the kernel value cannot be changed, DNAT redirection will not work.

• Validate module support:

perl /etc/csf/csftest.pl

Syntax

Rules are placed in /etc/csf/csf.redirect, one per line. Comments begin with #.

DNAT (redirect to a different IP)

Redirects traffic destined for one IP to another IP (optionally with port mapping):

IPx|*|IPy|*|tcp/udp          # All traffic to IPx → IPy (same port)
IPx|portA|IPy|portB|tcp/udp  # Traffic to IPx:portA → IPy:portB

REDIRECT (remap to a different port on the same host)

Redirects traffic arriving on one port to a different local port:

IPx|portA|*|portB|tcp/udp    # Traffic to IPx:portA → local portB
*|portA|*|portB|tcp/udp      # Traffic on any IP to portA → local portB

Constraint: port values must be single ports, not ranges.

Example use cases

Forward all TCP traffic from a public IP to an internal host

# /etc/csf/csf.redirect
203.0.113.50|*|198.51.100.10|*|tcp

All TCP connections to 203.0.113.50 are forwarded to 198.51.100.10.

Remap a non-standard port to a service port

# /etc/csf/csf.redirect
*|8025|*|25|tcp

TCP connections to port 8025 on any address are redirected to local port 25 (SMTP).

Per-IP port remapping

# /etc/csf/csf.redirect
203.0.113.60|8443|*|443|tcp

Only connections to 203.0.113.60:8443 are redirected to local port 443.

Safe workflow

1. Backup current redirect file:

cp /etc/csf/csf.redirect /etc/csf/csf.redirect.bak

2. Edit /etc/csf/csf.redirect and add your rule(s).
3. Reload CSF:

csf -r

4. Validate (see next section).
5. If validation fails, rollback (see below).

Validation steps

Confirm redirect rules are active

iptables -t nat -L PREROUTING -n --line-numbers | grep -i dnat
iptables -t nat -L PREROUTING -n --line-numbers | grep -i redirect

Test DNAT connectivity

From a remote client, connect to the original destination and verify traffic reaches the new target:

# From client — test that IPx:portA reaches IPy:portB
curl -v http://203.0.113.50:8025/

Test REDIRECT

# From any host — verify local port remap
telnet 203.0.113.60 8443

Check logs for issues

tail -n 50 /var/log/lfd.log

Rollback path

1. Restore the backup:

cp /etc/csf/csf.redirect.bak /etc/csf/csf.redirect

2. Reload CSF:

csf -r

3. Re-verify that redirect rules have been removed:

iptables -t nat -L PREROUTING -n | grep -iE "dnat|redirect"

Interaction with other CSF rules

• DNAT rules are applied in the PREROUTING NAT chain — they execute before CSF's INPUT chain filtering. Ensure the destination IP/port is also allowed in CSF policy if the target is on the same host.
• csf.allow / csf.deny rules apply to the original destination address, not the redirected address.
• Port redirection does not bypass connection-limit (CONNLIMIT) or port-flood (PORTFLOOD) rules on the destination port.

Common pitfalls

• IP forwarding disabled: DNAT silently fails if /proc/sys/net/ipv4/ip_forward is 0.
• NAT hairpin / loopback: traffic originating from the same host as the DNAT target may not work without explicit SNAT/masquerade rules — CSF does not configure this automatically.
• Redirect loops: redirecting port A → port B when port B also has a redirect creates a loop. CSF does not detect or prevent this.
• Source IP masking on DNAT: all redirected traffic appears at the destination with the redirecting server's IP as source, not the original client IP. This is by design and cannot be changed.
• Port ranges: specifying port ranges instead of single ports will cause the rule to fail silently.
• Using this for routing/VPN: this feature is designed for simple port/IP remapping, not general-purpose NAT or VPN tunneling.

See also

• Advanced Allow/Deny Filters
• External Pre and Post Scripts
• Configuration Guide

Last reviewed: 2026-02-27

---

← Previous: Connection Limit Protection · Next: Integrated User Interface Feature