0

I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence:

This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on the Linux box itself (routing, packet filtering) will see the packet going to its 'real' destination.

I want to ask what the author means by the last part i.e. anything else on the Linux box itself will see the packet going to its 'real' destination ?

I tried a test where I have a virtual device (tap) and I redirected incoming ICMP packets to that tap device (my tap device address is 10.0.4.1/24 and there is a program listening to the tap device, so its state is UP):

# iptables -t nat -A PREROUTING -i eth0 -p icmp -j DNAT --to-destination 10.0.4.2

When I ping an external IP, this rule never gets used (pkts count in iptables remains 0 for this rule). Is this observation related to what the author is saying ?

Improve this question

1 Answer 1

Reset to default
1

Your first question is already answered by the text you quoted:

This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on the Linux box itself (routing, packet filtering) will see the packet going to its 'real' destination.

I.e. routing and packet filtering.

For your second question: you seem to be pinging from the system itself. Hence the packets are not coming into the system, hence these packets don't pass through the PREROUTING chain. You will need to originate those packets from outside that system.

Improve this answer
4
  • In reference to the last diagram shown on this page: adminsehow.com/2011/09/iptables-packet-traverse-map, won't incoming ICMP packets come from "network" ? If not where do they fit in the diagram ? Thanks
    – Jake
    Mar 26, 2019 at 15:56
  • You mention packets not coming into the system. But the ICMP response will come from outside the box into the system. Could you please elaborate ? Thanks
    – Jake
    Mar 26, 2019 at 16:08
  • 1
    The ICMP packets are generated by the "Local process" box in the flow chart. And ICMP responses will only come if first triggered by some outgoing ICMP packets, for example.
    – wurtel
    Mar 27, 2019 at 9:33
  • In this diagram stuffphilwrites.com/wp-content/uploads/2018/11/…, is that what the localhost source ? check is on the left ? Does the kernel track whether incoming packets are due to an previous outgoing request ? If you could point to some documentation, then that would be great. Thank you.
    – Jake
    Mar 27, 2019 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .