Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

for example i added the following rule to the PREROUTING chain:

iptables -t nat -A PREROUTING -d 210.210.210.210 -j DNAT --to-destination 200.200.200.200

(lets say that both of the ip addresses are web servers on the internet)

now when i use any browser to surf to 210.210.210.210 i get redirected to 200.200.200.200 so far so good.. when i remove the rule from the chain right after i surf, and do a refresh or typing again the address adn press "go" i still get redirected to 200.200.200.200 its stay like this for a few minutes and after a while when i retry i get back to 210.210.210.210

if its a browser caching problem how can i force it not to cache the dns address or how can iptables prevent that from happening?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

NAT in Linux is implemented via the 'connection tracking' infrastructure. As the name implies it tracks connection. The nat rule only defines what do do when connection starts - then the NAT is set up, a conntrack rule is created and the iptables nat rule is not used for this connection any more.

The browser probably use persistent HTTP connection to the server and after you remove the rule the requests are sent over the already established connection.

The 'conntrack' utility ( http://linux.die.net/man/8/conntrack ) from the conntrack-tools package can help you remove the conntrack rule.

If that utility is not available to you, you may try to break the connection with another iptables rules, like this one (it stops all traffic to 200.200.200.200):

iptables -I FORWARD -d 200.200.200.200 -j REJECT

Often this needs to be inserted in the beginning of your FORWARD table ('-I'), a there is usually a rule to accept all established connections somewhere there already.

I used REJECT as this sends error response to the sender, which may break the connection earlier than DROP would.

share|improve this answer
    
i found the /proc/net/ip_conntrack log (that is updated at realtime) so im sure the router use it but when i type conntrack i get not found, any idea please? –  PyThoN May 27 '11 at 13:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.