I am trying to experiment with DNAT in PREROUTING. I found a tutorial here. It contains the following sentence:
This is done in the PREROUTING chain, just as the packet comes in; this means that anything else on the Linux box itself (routing, packet filtering) will see the packet going to its 'real' destination.
I want to ask what the author means by the last part i.e.
anything else on the Linux box itself will see the packet going to its 'real' destination ?
I tried a test where I have a virtual device (tap) and I redirected incoming ICMP packets to that tap device (my tap device address is
10.0.4.1/24 and there is a program listening to the tap device, so its state is UP):
# iptables -t nat -A PREROUTING -i eth0 -p icmp -j DNAT --to-destination 10.0.4.2
When I ping an external IP, this rule never gets used (
pkts count in iptables remains 0 for this rule). Is this observation related to what the author is saying ?