1

My iptables rules for nat table and chain POSTROUTING look like:

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
LOG        all  --  anywhere             anywhere             LOG level warning prefix " packet-pre-snat"
MASQUERADE  all  --  anywhere             anywhere            
LOG        all  --  anywhere             anywhere             LOG level warning prefix " packet-post-snat"

And I send a HTTP request between hosts an then look at log, I see only one entry:

Mar 15 08:41:55 vpn-instance5 kernel: [  385.657182]  packet-pre-snatIN= OUT=ens5 SRC=10.132.0.2 DST=10.0.0.24 LEN=60 TOS=0x00 PREC=0x00 TTL=61 ID=40 DF PROTO=TCP SPT=53896 DPT=443 WINDOW=65320 RES=0x00 SYN URGP=0 

Why do I see only one entry?

  1. I expect at least some entries (because there are many packets exchanged to establish a TCP connection.
  2. I see pre-snet log entries. Why I don't see post-snat entries (the third rule in iptables)
1
  • If you are using iptables -L -t nat, some important attributes of each rule may be hidden, e.g. if a rule affects inbound/outbound traffic in a particular interface only. Use iptables -L -vn -t nat to get the complete rule definitions. – telcoM Mar 15 at 10:40
1

You are not seeing post-snat entries because the third rule is never triggered, because MASQUERADE is a terminating target, while LOG is a non-terminating target.

When pre-snat LOG rule gets activated, iptables continues processing rules in the chain, goes to the MASQUERADE rule, while when MASQUERADE rules gets activated iptables stops processing rules in the chain, so the post-snat LOG rule under it never gets any packets processed by it so nothing gets logged by it.

Terminating targets: Terminating targets perform an action which terminates evaluation within the chain and returns control to the netfilter hook, goes to the next chain if there is any left.

Non-terminating targets: Non-terminating targets perform an action and continue evaluation within the chain.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.