Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have following rules:

iptables -t nat -I PREROUTING -d -p udp -m udp --dport 6881 -j DNAT --to-destination
iptables -N RTORR
iptables -I FORWARD -s -p udp -m udp --sport 6881 -j RTORR
iptables -A RTORR -d -j ACCEPT
iptables -A RTORR -j DROP

But filtering doesn't work. Looks like packets don't reach FILTER rule. Is it possible to filter prerouted packets?

share|improve this question

migrated from Feb 18 '11 at 18:07

This question came from our site for professional and enthusiast programmers.

Let's analyze your rules.

-t nat -I PREROUTING -d ... -j DNAT --to

Here, packets with dest-address of are DNAT-ed. Which means that the dest-address will be replaced with

-I FORWARD -s ... -j RTORR

This rule matches packets with src-address of If you expect packets DNAT-ed by the first rule to match this rule... well, think again.

As you can see, the first rule changes the dest-address, while this rule tries to match with src-address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.