Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to automatically handle packets in the OUTPUT chain of the NAT table (which are generated locally) like if they come from outside (via PREROUTING).

Is is possible to use a "forward everything to PREROUTING" as fallback / last rule in the OUTPUT chain?

E.g., given the following NAT-forwarding:

iptables -t nat -A PREROUTING -p TCP -d $EXT.IP.ADD.RESS \
    --dport 80 -j DNAT --to-destination $INT.IP.ADD.RESS:80

I have to setup a matching OUTPUT rule:

iptables -t nat -A OUTPUT -p TCP -d $EXT.IP.ADD.RESS \
    --dport 80 -j DNAT --to-destination $INT.IP.ADD.RESS:80

When logging these packets (via iptables -t nat -A OUTPUT -p TCP -d $EXT.IP.ADD.RESS -j LOG), they look like:

    TOS=0x00 PREC=0x00 TTL=64 ID=22348 DF PROTO=TCP SPT=59425 \
    DPT=25 WINDOW=32792 RES=0x00 SYN URGP=0

I've tried something like the following, but it did not work:

iptables -t nat -A OUTPUT -p TCP -d $EXT.IP.ADD.RESS -j DNAT \
    --to $EXT.IP.ADD.RESS

I am using the following macro/block now for every mapping of a port to an internal machine:

iptables -t nat -A PREROUTING -p TCP -d $EXT.IP.ADD.RESS --dport 25 \
    -j DNAT --to-destination
iptables -t nat -A OUTPUT -p TCP -d $EXT.IP.ADD.RESS --dport 25 \
    -j DNAT --to-destination
iptables -t nat -A POSTROUTING -p TCP -s -d --dport 25 \
    -j SNAT --to is the firewall, and the container (mail server).

I have only added the last rule ("POSTROUTING") lately, which allows for the container to reach itself.

share|improve this question
up vote 2 down vote accepted

Yes, this is called NAT Loopback and it requires you to SNAT your locally generated packets to your external IP. This will cause your packets to loop back around and go through your PREROUTING chain.

share|improve this answer

What do you intend to accomplish with reinjecting locally-generated packets (not forwarding) into PREROUTING? If you dislike the redundancy you have there, you can create a new user-defined chain, put the rule in there, and call this chain from PREROUTING and OUTPUT.

share|improve this answer
Yes, my main concern is to reduce duplication of logic ("port X should be handled by internal address Y"). Adding an extra chain does not make it much simpler AFAICS. I was just looking for a simplification, but apparently that's not possible here (using iptables alone). – blueyed Nov 23 '10 at 0:20

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.