I'm confused while trying to understand the DNAT mechanism under below circumstance.

My understanding:

DNAT = Destination Network Address Translation: Functionality which translates the destination address of the incoming packets to destination x.

I am facing difficulty in understanding the DNAT reply path.

For example: I have a machine (A) with an IP of x1 and wanted all connections/packets coming to this machine (dest y1) to get rerouted to another machine (B) with an IP address of z1.

So I added a new NAT rule as below:

iptables -t nat -A PREROUTING -s x1 -d y1 -j DNAT --to-destination z1.

Test on machine A: ping -I x1 y1

If I run tcpdump -i eth6 icmp on machine A then would I get a reply from IP y1 instead of z1? or it is something that the un-NAT is performed based on the subnet mask?

And when I monitored tcpdump -i eth6 host z1, there isn't any incoming ping or packet. Could someone clarify this scenario and my understanding ?

And also, is there anyway we can make this tcpdump if the packet is locally translated?

  • Is your complaint that y1 answers the ping to y1? If you want the address to change then you need masquerade (postroute).
    – Tim
    Dec 31, 2014 at 21:36
  • @Tim Thanks for quick prompt. I guess ill typo in your reply which I assume as below. I wasn't actually complaining about the behavior rather trying to understand the observed behavior. BTW, yes I was wondering why y1 is replying (as per tcpdump on Machine A) to x1 instead of z1. Thx
    – Snake
    Dec 31, 2014 at 21:42
  • One of the frequennt points of DNAT is that nobody outside should know about the machine doing the actual work (the one with the address f z1). As you are pinging y1 that's where you get your answer from even though the traffic might have been handled by another machine, but you're not supposed to know (or care). Dec 2, 2021 at 15:44

2 Answers 2


For forwarding ping requests, you need to explicitly specify ICMP protocol, like this:

iptables -t nat -I PREROUTING -d <ip y1> -p icmp -j DNAT --to-destination <ip z1>

However, PREROUTING won't work on a machine itself - in order to get this working, machine A has to be between you and pinged machine B.

YOU(ip x1) <---internet---> (ip y1) Machine A(ip z0) <---NATed LAN---> (ip z1)Machine B

This will work then like charm.

Here is how it looks on machine A with IP address y1 ( and z0 (, when I'm pinging y1 from my machine ( Machine B has IP address (z1):

16:23:54.181828 IP > ICMP echo request, id 25492, seq 0, length 64
16:23:54.181860 IP > ICMP echo request, id 25492, seq 0, length 64
16:23:54.182788 IP > ICMP echo reply, id 25492, seq 0, length 64
16:23:54.182806 IP > ICMP echo reply, id 25492, seq 0, length 64

Your fault is that you need three systems for this to make sense:

A -----> B

shall be replaced with

A -----> B -----> C

In this case you would need the PREROUTING chain on B as the packet would be delivered to the system from the outside.

But if you use iptables on the same system on which you create the packets then they are locally generated packets and those do not go through PREROUTING at all. With two systems you can do this:

A -----> B

shall be replaced with

A -----> C

(C need not exist if no reply is needed for testing DNAT.)

In that case you need such a rule:

 iptables -t nat -A OUTPUT -d y1 -j DNAT --to-destination z1

But if you change the target address to your own then the packet doesn't reach eth6 at all. You need tcpdump -i lo -n to see it.

  • @Haue Laging . Thanks for the prompt. I don't get the meaning of "locally generated packets" , do you mean locally translated packets (translated ip host is local?). Is there any other way I can check/verify the translated address/IP(z1) is getting the packet from x1 (other than mentioned ping?)
    – Snake
    Jan 1, 2015 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .