1

I'm trying to continuously change the iptables nat rules, more precisely, changing the Destination-Port on run time. However, I see that only the first packet in a stream hits the nat table. After that, the rest of the packets will automatically have the same action taken on them as the first packet, even if the rule has alreaddy changed.

e.g.

sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -i eth0 -j REDIRECT --to-port 9999

or

sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -i eth0 -j DNAT --to-port 9999

This will only take effect if the rule exists before the flow starts.

... ...

Moreover, as a remedy, I tried to stop connection tracking as follows:

sudo iptables -t raw -A PREROUTING -p tcp -m tcp --dport 80 -i eth0 -j NOTRACK 
sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -i eth0 -m conntrack --ctstate UNTRACKED -j REDIRECT --to-port 9999

or

sudo iptables -t raw -A PREROUTING -p tcp -m tcp --dport 80 -i eth0 -j NOTRACK
sudo iptables -t nat -I PREROUTING -p tcp --dport 80 -i eth0 -m state --state UNTRACKED -j DNAT --to-port 9999

but it is not working as well, Please help me in this matter. Thanks in advance ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.