I would like to let locally generated packets pass through PREROUTING chain bacause I want to use

sudo iptables -t mangle -A PREROUTING -p tcp -d somewebsite.com -j TPROXY --on-port 32794

to redirect all packets (generated by a local process) heading to somewesite.com to local port 32794.

Many people suggested this instead:

sudo iptables -t nat -A OUTPUT -p tcp -d somewebsite.com -j REDIRECT --to-ports 32794

but REDIRECT will modify packet header which I am trying to avoid. I have to use TPROXY, it's the only type of target that doesn't modify packet headers.

So what should I do to let locally generated packets pass through PREROUTING chain? Maybe using loopback? But I am not sure whether loopback changes packet headers either...


iptables is set of rules (or ruleset), which can be found inside chains. Chains are inside the tables.

In your case, you used the REDIRECT target but this actually modifies the packets to change the destination address which might not be acceptable, and it is bound to the nat table in most cases.

The TPROXY target provides similar functionality and relies on mangle table. Simply add rules like this to the iptables ruleset:

iptables -t mangle -A PREROUTING -p tcp -d your.ip.address.here --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 32794 --on-ip=

Note: I also used the mark but these should not alter the TCP header.

  • The problem is locally generated packets don't pass through PREROUTING chain – yi-ji Sep 17 '18 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.