Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The issue: I am currently redirecting port 80 requests to another system on port 1000.

This is done like so:

iptables -t nat -A PREROUTING ! -s -p tcp --dport 80 -j DNAT --to-destination

However, when adding -m string --algo kmp --string 'MSIE' to filter packets with MSIE in them, they are being ignored due the prerouting only evaluating the first SYN packet(therefore missing the HTTP packets with the headers I am trying to evaluate)

The broken rule:

iptables -t nat -A PREROUTING ! -s -p tcp --dport 80 -j DNAT --to-destination --algo kmp -m string --string 'MSIE'

My Question: How can I evaluate the HTTP Headers and redirect the packet or fire off a system event when a string match occurs?

share|improve this question
Is the "broken rule" exactly how you are entering it? The syntax seems off. – Tim Jun 25 '13 at 20:28
up vote 3 down vote accepted

Quoting the man page:

DNAT (IPv4-specific)

This target is only valid in the nat table, in the PREROUTING and OUTPUT chains, and user-defined chains which are only called from those chains.

In other words: You lost, it's not possible. And that is obvious as you cannot change the target address in the middle of a connection (without repairing that at the new destination).

You want the application layer, you need an application. Redirect all packets to a (transparent) proxy which can decide what to do with the connections.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.