I have a server with forwarding turned on. I placed an iptables LOG target in the PREROUTING, INPUT, and FORWARD chains of the mangle table. I can see the LOG messages from PREROUTING, but not INPUT or FORWARD. I have no iptables rules other than the logging. Why does the packet not get past the PREROUTING chain?
From various netfilter charts, it seems that the only thing that can stop it is the routing decision. I have checked that forwarding is turned on, I don't have any special routing policies setup, and I do have a route to the packet's destination. Reverse path filtering is disabled.
One netfilter chart suggests the packet goes through QOS ingress at that point. I'm not too familiar with QOS, but I've not done anything special with tc. My qdiscs are pfifo_fast (the default), and there are no filters.
Additional details: This is an IPsec tunnel endpoint. The packets are coming in through IPsec, getting transformed successfully, and re-entering the networking stack. It is at this stage that I see the packet get stopped after PREROUTING before either INPUT or FORWARD.