Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

for example i added the following rule to the PREROUTING chain:

iptables -t nat -A PREROUTING -d -j DNAT --to-destination

(lets say that both of the ip addresses are web servers on the internet)

now when i use any browser to surf to i get redirected to so far so good.. when i remove the rule from the chain right after i surf, and do a refresh or typing again the address adn press "go" i still get redirected to its stay like this for a few minutes and after a while when i retry i get back to

if its a browser caching problem how can i force it not to cache the dns address or how can iptables prevent that from happening?

share|improve this question
up vote 2 down vote accepted

NAT in Linux is implemented via the 'connection tracking' infrastructure. As the name implies it tracks connection. The nat rule only defines what do do when connection starts - then the NAT is set up, a conntrack rule is created and the iptables nat rule is not used for this connection any more.

The browser probably use persistent HTTP connection to the server and after you remove the rule the requests are sent over the already established connection.

The 'conntrack' utility ( ) from the conntrack-tools package can help you remove the conntrack rule.

If that utility is not available to you, you may try to break the connection with another iptables rules, like this one (it stops all traffic to

iptables -I FORWARD -d -j REJECT

Often this needs to be inserted in the beginning of your FORWARD table ('-I'), a there is usually a rule to accept all established connections somewhere there already.

I used REJECT as this sends error response to the sender, which may break the connection earlier than DROP would.

share|improve this answer
i found the /proc/net/ip_conntrack log (that is updated at realtime) so im sure the router use it but when i type conntrack i get not found, any idea please? – PyThoN May 27 '11 at 13:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.