DNAT packet after decryption of ipsec

Question

how to DNAT packet decrypted by ipsec. encrypted packet is: sourceIP: 192.168.4.6 destIP 10.10.0.100:

If i simply :

 iptables -t nat -A PREROUTING  d 10.10.0.100 -j DNAT --to-destination 10.0.0.5

it doesnt work - it seems that prerouting is doing nat on encrypted traffic - how to force it to work after decryption ?

MadHatter · Accepted Answer · 2014-10-20 12:41:51Z

1

Tell your rule only to match traffic that's been through the ipsec decrypt-and-verify step:

iptables -t nat -A PREROUTING -d 10.10.0.100 -m policy --pol ipsec --dir in -j DNAT --to-destination 10.0.0.5

answered Oct 20, 2014 at 11:12

MadHatter

80.6k20 gold badges187 silver badges233 bronze badges

hmm - i have an error: Cannot use -X with A
– Kriss
Oct 20, 2014 at 11:58
What line did you enter? I see no -X above!
– MadHatter
Oct 20, 2014 at 12:03
i have entered: iptables -t nat -A PREROUTING -d 10.88.15.159 --pol ipsec --dir in -j DNAT --to-destination 10.0.0.5 and got an error: iptables v1.4.14: Cannot use -X with -A
– Kriss
Oct 20, 2014 at 12:08
Weird, me too. Never seen that before. Try the above, which doesn't throw the same error.
– MadHatter
Oct 20, 2014 at 12:41
i have changet it to iptables -t nat -A PREROUTING -d 10.88.15.159 --match policy --pol ipsec --dir in -j DNAT --to-destination 10.0.0.5 and no error but i am not sure if it works correctly
– Kriss
Oct 20, 2014 at 12:48

| Show 3 more comments

1 Answer 1