If there is a DNAT rule in the PREROUTING chain like this one:

iptables -t nat -A PREROUTING -j DNAT --to-destination x.x.x.x

All packets reaching the stack from a network interface will first pass through the PREROUTING chain (after conntrack and ignoring raw/mangle/security tables) and will get their destination address patched to x.x.x.x.

My question is: When do response packets from x.x.x.x get their source address patched back with the inverse operation so that it now appears that these packets are sent by the original destination of the first packets and not x.x.x.x?

My guess is that it's done as soon as possible so that nat rules are 'transparent' to other rules in other chains.

  • 1
    A corresponding explicit SNAT rule must be in the POSTROUTING chain (and there's also the INPUT/OUTPUT pair), so my guess would be "in the corresponding chain according to that pairing". But I didn't verify that. The mechanism for this is provided by conntrack, so another option is "conntrack completely takes the response out of the chain processing". – dirkt Jul 1 '18 at 13:13
  • 1
    Only packets representing new connections hit the nat chains, but all packets hit the other iptables chains (that is why most configurations have an "allow established and related" rule). So where the inverse NAT translations happen in relation to those chains is potentially significant. – plugwash Oct 15 '18 at 14:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.