22

Okay, it may be because I am dense or maybe just not finding the right source, but I can't understand why one of these IPTABLES setups would be better than the other.

Here is my setup:

I have a box that is serving as a transparent proxy and a router or sorts. It has two interfaces on it, ETH0 and ETH1, and the following address scheme:

ETH0 = DHCP ETH1 = 192.168.5.1/24 serving up DHCP for the 192.168.5.0/24 network to clients behind it in the LAN

I have privoxy installed and listening on port 8080 as a transparent proxy. What I am accomplishing with this setup is to be able to drop this box into an existing network with minimal configuration and attached clients to the proxy.

Here is my original IPTABLES file

*nat
-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j REDIRECT --to-port 8080
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
*filter
COMMIT

This configuration works fine and traffic is flowing back and forth without issue. I get the originating clients IP address in the privoxy logfiles, and life is good.

My confusion comes in when I start looking at other people's configurations and see that they are using DNAT instead of REDIRECT, and I am trying to understand the real beneift of one over the other. Here is a sample config:

*nat
-A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to 192.168.5.1:8080
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
*filter
COMMIT

Again, this configuration works too, and gives me all I need from a logging perspective...

Which is is right, or maybe MORE right, than the other one?

Thanks for taking time to read this far...

3 Answers 3

19

REDIRECT alters the destination IP address to send to the machine itself. In other words, locally generated packets are mapped to the 127.0.0.1 address. It's for redirecting local packets. If you only want to redirect the traffic between services on the local machine, it will be a good choice.

DNAT is actual Network Address Translation. If you want packets destinated outside of the local system to have the destination altered, it's the better choice of the two, as REDIRECT will not work.

3
  • okay, so if I have a client sitting behind the proxy, say on 192.168.5.234, and I want to "process" its HTTP requests through the proxy on 192.168.5.1, you are suggesting that I should DNAT outbound port 80 traffic to 192.168.5.1:8080 on the proxy. I can buy that, but WHY???? Is it something to do with how the traffic is handled once it leaves the proxy's ETH0 on its way out through the default gateway to the Internet? I need to grok this or my head will explode
    – QWade
    Sep 8, 2010 at 14:47
  • 2
    DNAT changes the address as the packet passes through the firewall so that it arrives at the desidered host, and on the reverse appears to have come from the firewall. DNAT almost never applies to outbound traffic, which is handled by the MASQUERADE rule. It the privproxy was on an another host, then DNAT would be appropriate, with an appropriate exception for that host.
    – BillThor
    Sep 8, 2010 at 16:28
  • Bill, thank you. That is where my reptilian brain was going, but is it always nice to have validation. So if I send a packet destined for google.com from 192.168.5.234 and it has its default gw set as 192.168.5.1 (eth1 on the proxy), I should "REDIRECT" that packet to port 8080 on the proxy and let privoxy do the rest. The reason for this is because privoxy lives on 192.168.5.1 and not on another host. Am I smoking something I shouldn't?
    – QWade
    Sep 8, 2010 at 16:52
18

REDIRECT does alter the destination IP address to send to the machine itself as answered by Warner@. But I'd say that answer is not totally correct, or a bit misleading.

REDIRECT is not just for redirecting local packets. It is really DNAT in which the destination IP address to use is implicit, 127.0.0.1 if it is a local packet or the machine interface's IP address otherwise, 192.168.5.1 in the case of the OP.

So in this question, no matter what the final destination, the packets should first reach the proxy, so REDIRECT is perfectly suited.

Since with REDIRECT you don't need to specify the IP address, it will just take the right one, it has some advantages over DNAT:

  • If the machine's IP address changes for any reason you don't need to modify your rules, and in particular DNAT will not work for DHCP-controlled interfaces.

  • You can write and maintain the same rules for several systems (several proxy instances for example) without keeping different slightly versions because of the specific IP addresses.

5
  • somehow like snat/masquerade.
    – Jichao
    Jul 18, 2019 at 3:10
  • 2
    @Hod, I hear REDIRECT is a special case of DNAT, but I use REDIRECT and TOR knows the actual destination of a packet, so I conclude daddr and dport of iphdr and tcphdr structures are intact, and the packet just returned to REDIRECT destination by kernel. DNAT will actually modify the structures. Am I wrong?
    – wick
    Sep 22, 2019 at 10:58
  • This is not entirely accurate. As @ikiddo referenced below, the traffic is redirected to the address of the incoming interface and not to 127.0.0.1, as stated in the answer from julio-diez above. This distinction is important, because if you are using DNAT with destination address 127.0.0.1 on your WAN interface, you would get a "IPv4: martian destination 127.0.0.1 from w.x.y.z, dev pppoe0" in your syslog and those packets would be dropped before reaching the local process. So you either need to use DNAT with the actual interfaces IP address or you need to use REDIRECT.
    – hanjo
    Nov 28, 2023 at 7:37
  • @hanjo Not sure to follow your example (martian packets can happen several ways, and not always necessarily need to be dropped). But my answer is correct, except maybe because I omitted to include IPv6 (on purpose). You said "traffic is redirected to the address of the incoming interface and not to 127.0.0.1", but I specified "127.0.0.1 if it is a local packet". Think on this, what is the incoming interface for a locally-generated packet?
    – Julio Diez
    Nov 29, 2023 at 13:18
  • @JulioDiez reading this again, I think you are correct. I might have missed this when I originally worked through it. My point is: to avoid issues, always use REDIRECT when the packet is supposed to stay on the local machine or be extra careful that the destination address matches the interface when using DNAT. You can only use 127.0.0.1 if the interface is the loopback interface.
    – hanjo
    Jan 11 at 11:08
2

DNAT and REDIRECT are exactly the same, if you want to send traffic to the local machine.

The documentation states it like so: "[Redirection] is a specialized case of Destination NAT called redirection: it is a simple convenience which is exactly equivalent to doing DNAT to the address of the incoming interface."

https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html#ss6.2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .