Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a STUN service running on the same machine that is the gateway for the LAN, I would like the results from the STUN service be the same for both internal and external machines. Currently since the masquerading is done in the postrouting rule when the packets leave the gateway the STUN server will just see the LAN IP/port instead of the natted ip/port.

eth1 (lan):
eth0 (wan):
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE 
iptables -A INPUT -p udp -d --dport 3701 -j ACCEPT

When a LAN machine with IP contacts the STUN service at the packets get through but the STUN service see that the packet gets sent from

How can I get the NAT translation to occur before the packet arrive to the STUN service and that the response back from the STUN service won't be from but rather the used when contacting the service?

share|improve this question

Look at the image. Packets gets translated by MASQUERADE when they are to be routed. But your destionation host it the same host as router. So packet won't go through nat-POSTROUTING chain and won't be translated. They will go through filter table instead

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.