Is it possible to filter prerouted packets in iptables?

Question

I have following rules:

iptables -t nat -I PREROUTING -d 1.2.3.4 -p udp -m udp --dport 6881 -j DNAT --to-destination 10.11.12.6
iptables -N RTORR
iptables -I FORWARD -s 10.11.12.16 -p udp -m udp --sport 6881 -j RTORR
iptables -A RTORR -d 2.3.4.5 -j ACCEPT
iptables -A RTORR -j DROP

But filtering doesn't work. Looks like packets don't reach FILTER rule. Is it possible to filter prerouted packets?

Answer 1

Let's analyze your rules.

-t nat -I PREROUTING -d 1.2.3.4 ... -j DNAT --to 10.11.12.16

Here, packets with dest-address of 1.2.3.4 are DNAT-ed. Which means that the dest-address will be replaced with 10.11.12.16

-I FORWARD -s 10.11.12.16 ... -j RTORR

This rule matches packets with src-address of 10.11.12.16. If you expect packets DNAT-ed by the first rule to match this rule... well, think again.

As you can see, the first rule changes the dest-address, while this rule tries to match with src-address.