Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Gentoo Linux system running linux 2.6.38-rc8. I also have a machine running Ubuntu with linux 2.6.35-27. I also have a virtual machine running Debian Unstable with linux 2.6.37-2.

On the Gentoo and Debian systems I have an INPUT chain built into my nat table in addition to PREROUTING, OUTPUT, and POSTROUTING. On Ubuntu, I only have PREROUTING, OUTPUT, and POSTROUTING.

I am able to use this INPUT chain to use SNAT to modify the source of a packet that is destined to the local machine (imagine simulating an incoming spoofed IP to a local application or just to test a virtual host configuration). This is possible with 2 firewall rules on Gentoo and Debian but seemingly not so on Ubuntu. I looked around for documentation on changes to the SNAT target and the INPUT chain of the nat table and I couldn't find anything.

Does anyone know if this is a configuration issue or is it something that was just added in more recent versions of linux?

share|improve this question
Honestly, this is the first time I've ever heard of -t nat -A INPUT. Can't even find the most up-to-date man page for iptables referring to nat/INPUT. – pepoluan Mar 10 '11 at 8:45

It looks like this was added some time after 2.6.35, see commit c68cd6cc21eb329c47ff020ff7412bf58176984e

share|improve this answer
Ahh, thanks for the link. Geez, the netfilter guys should really recruit someone to keep their man pages up-to-date. – pepoluan Mar 10 '11 at 9:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.