I tried to do something similar to this question


So I want to make all out-going traffic to port 44444 redirected to

iptables -t nat -A OUTPUT -p tcp --dport 44444 -j DNAT --to-destination
iptables -t nat -A OUTPUT -p tcp --dport 44444 -j LOG --log-prefix

However the traffic is still going to original IP, not

I am trying to setup it on my OpenWRT router, verison is:

MTK OpenWrt SDK V3.4
revision : e7847192
benchmark : APSoC SDK
Linux 3.10.14
iptables v1.4.21

Is there anything I did wrong?

  • You've described what you've done, but you haven't described any actual problem. Does it work, is it doing what you expected? Have you tried monitoring the interface(s) with tcpdump or wireshark to see if the packets are being redirected? – cas Jan 17 '18 at 16:10
  • @cas sorry, my problem is traffic was NOT going to Nothing seemed to work. I am using tcpdump in this case. – est Jan 17 '18 at 16:13

Seems to work for me:

# iptables -tnat -A OUTPUT -p tcp --dport 44444 -j DNAT --to-destination $someip:8888
$ nc $someotherip 44444
# tcpdump -n ...
18:23:54.699942 IP [my ip].55212 > [someip].8888: Flags [S], seq 1138760196, ...

If I understand this part of the iptables man page correctly, OUTPUT only applies to connections that originate from the host itself, not routed connections. Are you sure you don't want to put the rule in PREROUTING?

This table is consulted when a packet that creates a new connection is encountered. It consists of four built-ins: ..., OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about to go out).

  • 1
    Oh, it seems I didn't grasp the meaning of OUTPUT. I switched to PREROUTING and it works. Thanks. – est Jan 18 '18 at 0:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.