Out of curiosity I'm reading some tutorials about transparent TOR proxies as it's quite interesting topic from a networking standpoint. As opposed to VPN gateways which just use tun/tap interfaces and are totally clear to me, TOR proxy uses a single port. All tutorials repeat the magic line:

iptables -t nat -A PREROUTING -i eth0 -p tcp --syn -j REDIRECT --to-ports 9040

where eth0 is the input (LAN) interface and 9040 is some TOR port. The thing is, I completely don't get why such a thing makes sense at all from networking standpoint.

According to my understanding of redirect / dst-nat chains and how it seems to work in physical routers, dst-nat chain takes dst-port and dst-addr BEFORE routing decision is taken and changes them to something else. So for example:

  • before dst-nat: ->
  • after dst-nat: ->

And is what further chains in IP packet flow lane see (for example filter table) and this is how the packet looks from now on after leaving device for example.

Now many people around the internet (including on this stackexchange) claimed that redirect is basically the same as dst-nat with dst-addr set to local address of interface. In such light, this rule:

iptables -t nat -A PREROUTING -i eth0 -p tcp --syn -j REDIRECT --to-ports 9040

clearly doesn't make sense. If that would be how it works, then TOR would get all packets with destination For typical applications where app takes packet and responds to it somehow (for example web servers) it totally makes sense because after all, such a server process is the final destination of the packet anyways so it's okay that the destination address is localhost. But TOR router is well... a router so it has to know original destination of packet. Am I missing something? Does DNAT not affect what local applications receive? Or is it specific behavior of REDIRECT directive?

  • I installed demo and it does work. What's more - I've set up nodejs server in place of tor and it really does show as destination in connection details so I have no idea how Tor proxy knows what is actual destination of packet... It's complete... magic
    – Lapsio
    Commented Dec 29, 2017 at 4:09

2 Answers 2


Take a look at this answer: How does a transparent SOCKS proxy know which destination IP to use?


iptables overrites the original destination address but it remembers the old one. The application code can then fetch it by asking for a special socket option, SO_ORIGINAL_DST.


Actually you're right about TOR, every tcp packet received is redirect to localhost:9040.

The target REDIRECT is special type of the DNAT target, which would change the ip address to the local interface and map to the port whatever you specified.

Suppose there is a router whose lan interface is eth0(with network and ip address: and the iptables rule for this router is:

iptables -t nat -A PREROUTING -i eth0 -p tcp --syn -j REDIRECT --to-ports 9040

then all the tcp packets from the clients inside the lan would redirect to

Suppose there is tcp connection from client(with ip address inside the lan to google.com(suppose ip: then,

raw request: ->

after router's prerouting chain:>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .