redirection made by iptables take effect even after i removed the rule from the chain

Question

for example i added the following rule to the PREROUTING chain:

iptables -t nat -A PREROUTING -d 210.210.210.210 -j DNAT --to-destination 200.200.200.200

(lets say that both of the ip addresses are web servers on the internet)

now when i use any browser to surf to 210.210.210.210 i get redirected to 200.200.200.200 so far so good.. when i remove the rule from the chain right after i surf, and do a refresh or typing again the address adn press "go" i still get redirected to 200.200.200.200 its stay like this for a few minutes and after a while when i retry i get back to 210.210.210.210

if its a browser caching problem how can i force it not to cache the dns address or how can iptables prevent that from happening?

Answer 1

NAT in Linux is implemented via the 'connection tracking' infrastructure. As the name implies it tracks connection. The nat rule only defines what do do when connection starts - then the NAT is set up, a conntrack rule is created and the iptables nat rule is not used for this connection any more.

The browser probably use persistent HTTP connection to the server and after you remove the rule the requests are sent over the already established connection.

The 'conntrack' utility ( http://linux.die.net/man/8/conntrack ) from the conntrack-tools package can help you remove the conntrack rule.

If that utility is not available to you, you may try to break the connection with another iptables rules, like this one (it stops all traffic to 200.200.200.200):

iptables -I FORWARD -d 200.200.200.200 -j REJECT

Often this needs to be inserted in the beginning of your FORWARD table ('-I'), a there is usually a rule to accept all established connections somewhere there already.

I used REJECT as this sends error response to the sender, which may break the connection earlier than DROP would.