Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How to change destination IP address after routing decision was made, i.e. in POSTROUTING chain of iptables?

share|improve this question
Can you tell us why you would even want to? – Zoredache Mar 24 '10 at 17:38
Are you trying to do NAT? – einstiien Mar 24 '10 at 17:42

e... as the name suggests - it is a bit too late to do it in the POSTROUTING table.

this and this are quite helpful to see what/when happens. if you really have to dst address rewrite - maybe put another machine in the line [ virtual ? ] or even better - rethink why would you want to do that.

share|improve this answer

If you really want to change the destination in POSTROUTING, perhaps you can try abusing the NETMAP target? I'm not sure if it works, but try something like:

iptables -t nat -A POSTROUTING -d -j NETMAP --to=
share|improve this answer

I don't think there's a good answer for this. I don't think iptables lets you change the destination IP address after routing. What I want to do is:

iptables -t nat -A POSTROUTING -o eth0 -p udp -d --dport 53 -m comment --comment "Redirect DNS when VPN is down" -j DNAT --to-destination

But that isn't legal. I want to change the destination address based on the output interface, which isn't known until after routing.

If you could change the destination IP address, it would be too late to change the routing (which would be fine for my example use). You only get to route packets once.

The only solution I'm aware of would be to have a virtual machine that sits between eth0 and the real network which could then do DNAT.

For my purposes, I can dynamically add or remove a prerouting rule when the VPN interface goes down or comes up, but it feels like a clumsy solution.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.