0

I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence:

This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on the Linux box itself (routing, packet filtering) will see the packet going to its 'real' destination.

I want to ask what the author means by the last part i.e. anything else on the Linux box itself will see the packet going to its 'real' destination ?

I tried a test where I have a virtual device (tap) and I redirected incoming ICMP packets to that tap device (my tap device address is 10.0.4.1/24 and there is a program listening to the tap device, so its state is UP):

# iptables -t nat -A PREROUTING -i eth0 -p icmp -j DNAT --to-destination 10.0.4.2

When I ping an external IP, this rule never gets used (pkts count in iptables remains 0 for this rule). Is this observation related to what the author is saying ?

1

Your first question is already answered by the text you quoted:

This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on the Linux box itself (routing, packet filtering) will see the packet going to its 'real' destination.

I.e. routing and packet filtering.

For your second question: you seem to be pinging from the system itself. Hence the packets are not coming into the system, hence these packets don't pass through the PREROUTING chain. You will need to originate those packets from outside that system.

  • In reference to the last diagram shown on this page: adminsehow.com/2011/09/iptables-packet-traverse-map, won't incoming ICMP packets come from "network" ? If not where do they fit in the diagram ? Thanks – Jake Mar 26 at 15:56
  • You mention packets not coming into the system. But the ICMP response will come from outside the box into the system. Could you please elaborate ? Thanks – Jake Mar 26 at 16:08
  • 1
    The ICMP packets are generated by the "Local process" box in the flow chart. And ICMP responses will only come if first triggered by some outgoing ICMP packets, for example. – wurtel Mar 27 at 9:33
  • In this diagram stuffphilwrites.com/wp-content/uploads/2018/11/…, is that what the localhost source ? check is on the left ? Does the kernel track whether incoming packets are due to an previous outgoing request ? If you could point to some documentation, then that would be great. Thank you. – Jake Mar 27 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.