I'm confused while trying to understand the DNAT mechanism under below circumstance.

My understanding:

DNAT = Destination Network Address Translation: Functionality which translates the destination address of the incoming packets to destination x.

I am facing difficulty in understanding the DNAT reply path.

For example: I have a machine (A) with an IP of x1 and wanted all connections/packets coming to this machine (dest y1) to get rerouted to another machine (B) with an IP address of z1.

So I added a new NAT rule as below:

iptables -t nat -A PREROUTING -s x1 -d y1 -j DNAT --to-destination z1.

Test on machine A: ping -I x1 y1

If I run tcpdump -i eth6 icmp on machine A then would I get a reply from IP y1 instead of z1? or it is something that the un-NAT is performed based on the subnet mask?

And when I monitored tcpdump -i eth6 host z1, there isn't any incoming ping or packet. Could someone clarify this scenario and my understanding ?

And also, is there anyway we can make this tcpdump if the packet is locally translated?

  • Is your complaint that y1 answers the ping to y1? If you want the address to change then you need masquerade (postroute). – Tim Dec 31 '14 at 21:36
  • @Tim Thanks for quick prompt. I guess ill typo in your reply which I assume as below. I wasn't actually complaining about the behavior rather trying to understand the observed behavior. BTW, yes I was wondering why y1 is replying (as per tcpdump on Machine A) to x1 instead of z1. Thx – Snake Dec 31 '14 at 21:42

Your fault is that you need three systems for this to make sense:

A -----> B

shall be replaced with

A -----> B -----> C

In this case you would need the PREROUTING chain on B as the packet would be delivered to the system from the outside.

But if you use iptables on the same system on which you create the packets then they are locally generated packets and those do not go through PREROUTING at all. With two systems you can do this:

A -----> B

shall be replaced with

A -----> C

(C need not exist if no reply is needed for testing DNAT.)

In that case you need such a rule:

 iptables -t nat -A OUTPUT -d y1 -j DNAT --to-destination z1

But if you change the target address to your own then the packet doesn't reach eth6 at all. You need tcpdump -i lo -n to see it.

  • @Haue Laging . Thanks for the prompt. I don't get the meaning of "locally generated packets" , do you mean locally translated packets (translated ip host is local?). Is there any other way I can check/verify the translated address/IP(z1) is getting the packet from x1 (other than mentioned ping?) – Snake Jan 1 '15 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.