Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have following rules:

iptables -t nat -I PREROUTING -d 1.2.3.4 -p udp -m udp --dport 6881 -j DNAT --to-destination 10.11.12.6
iptables -N RTORR
iptables -I FORWARD -s 10.11.12.16 -p udp -m udp --sport 6881 -j RTORR
iptables -A RTORR -d 2.3.4.5 -j ACCEPT
iptables -A RTORR -j DROP

But filtering doesn't work. Looks like packets don't reach FILTER rule. Is it possible to filter prerouted packets?

share|improve this question

migrated from stackoverflow.com Feb 18 '11 at 18:07

This question came from our site for professional and enthusiast programmers.

1 Answer 1

Let's analyze your rules.

-t nat -I PREROUTING -d 1.2.3.4 ... -j DNAT --to 10.11.12.16

Here, packets with dest-address of 1.2.3.4 are DNAT-ed. Which means that the dest-address will be replaced with 10.11.12.16

-I FORWARD -s 10.11.12.16 ... -j RTORR

This rule matches packets with src-address of 10.11.12.16. If you expect packets DNAT-ed by the first rule to match this rule... well, think again.

As you can see, the first rule changes the dest-address, while this rule tries to match with src-address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.