Is the iptables' MASQUERADE a terminating or non-terminating target ?

Where is this officially documented ? The Netfilter's extensions man page does not mention it...

  • It's terminating. You can answer your own q by 1. adding a log rule just after it and see that it doesn't get hit and 2. look at its source code in the kernel and see that it can only return NF_DROP or NF_ACCEPT, not XT_CONTINUE. – pizdelect Nov 24 '19 at 21:40
  • They're probably only documenting when a target is non- terminating, since that's the exception. Besides, I don't see how MASQUERADE could be non-terminating. How could that work? – pizdelect Nov 24 '19 at 21:45
  • OK, guys - it's an answer...so please make it an answer so I can accept it and others can benefit from this knowledge. – George Robinson Nov 24 '19 at 23:06

All NAT rules are terminating. Matching 2 nat rule at same time would be nonsense. Note that, by terminating I mean packet will exit from NAT rules and continue to other tables.

In addition, when first packet match a rule in NAT chains, other packets from same connection also will not traverse NAT chains.

  • Firstly, it is impossible for the packet processed by the MASQUERADE target to "continue to other tables" because the MASQUERADE target MUST be in the nat:POSTROUTING chain and this is the LAST chain before the packet is transmitted by the outbound interface. See: i.stack.imgur.com/niGU1.png – George Robinson Nov 25 '19 at 21:30
  • Secondly, processing a second rule - a rule AFTER the MASQUERADE target is processed, is not "nonsense" when one needs to e.g. to clone the output of the MASQUERADE target with a TEE for the purposes of monitoring / debugging the output of the outbound interface. Sadly this is impossible because the MASQUERADE target is "terminating". See this: unix.stackexchange.com/questions/553899/… – George Robinson Nov 25 '19 at 21:33
  • @GeorgeRobinson I know MASQUERADE can only be used in POSTROUTING. I just generalized answer. If I clone packet with TEE it will create new packet an still it is nonsense to match 2 nat rule at same time for each packets. – ibrahim Nov 26 '19 at 15:14
  • The cloned packet will not be matched by the same rule in the nat:POSTROUTING chain, because the cloned packet is purposely marked to avoid just this scenario. Also, 2 rules in the nat:POSTROUTING chain having a TEE and the MASQUERADE targets (in that order!) make perfect sense if one wants to monitor the commencements of outbound connections on e.g. a dedicated host on the LAN running "Wireshark". Also, I still cannot agree that "packet will exit from NAT rules and continue to other tables" because no other tables exist after nat:POSTROUTING and that's where the MASQUERADE must be – George Robinson Nov 27 '19 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.