Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a machine that has a DNAT rule that redirects data to neighbouring server:

iptables -t nat -A PREROUTING -p udp -d --dport 54321 -j DNAT --to

As can be seen, this rule is triggered quite frequently:

pkts bytes target     prot opt in     out     source               destination         
192K   19M DNAT       udp  --  *      *         udp dpt:54321 to: 

However, looking at the interface, the redirected packets are not sent out on the interface.

$ tcpdump -i eth0 -n port 54321
17:03:36.553363 IP > UDP, length 82
17:03:37.514257 IP > UDP, length 39
17:03:37.633556 IP > UDP, length 82
17:03:37.678211 IP > UDP, length 68
17:03:38.542620 IP > UDP, length 39

This problem occurred after the machine rebooted for the first time after adding these rules, so presumably there is some difference between then and now. But what? Or is there some kernel bug that means these packets are dropped even tho the counter is incremented?

The machine is a CentOS4 box, Linux 2.6.9-67.0.1.ELsmp.

share|improve this question
up vote 3 down vote accepted

You also need a FORWARD rule, for example:

iptables -t filter -I FORWARD -m udp -p udp --dst --dport 54321 -j ACCEPT

and to enable forwarding, of course:

sysctl -w net.ipv4.ip_forward=1
share|improve this answer
Forwarding chain was default ACCEPT, but a echo 1 > /proc/sys/net/ipv4/conf/eth0/forwarding made a significant difference :). On behalf of a lot of customers: thank you! – Bittrance Oct 10 '11 at 15:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.