Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a strange question regarding NAT using iptables.

When I do SNAT in a postrouting chain in NAT table at the end of the rule should I give -J ACCEPT?

I see counters on the postrouting rule getting incremented but no packet leaving the machine. So does it mean the packet is DROPPED automatically?

share|improve this question

No. There is only one target (-j) per rule. The -j SNAT is exclusive, you can't provide two targets for a rule. If you need to accept the packet, the 'ACCEPT' target should be used in the 'FORWARD' chain of the 'filter' table.

Packets are only dropped if there is a rule to drop them, or if the default policy of the 'FORWARD' chain is 'DROP'. In both case, these counters are updated.

More likely, routing is not enabled or your routing tables are not complete.

To enable routing:

sysctl net.ipv4.ip_forward=1
share|improve this answer
Ok I got you ... but the counter shows that POSTROUTING chain in NAT table has received one packet but the tcpdump doesn't shows any packet leaving from machine. So it means eventhough counter at POSTROUTING is incremented the packet might be dropped ?? I think POSTROUTING chain under nat table is the last chain before the packet leaves out. – codingfreak Oct 26 '09 at 13:47
What are the policies of the POSTROUTING chain in each table? Also note that due to the operating system architecture, tcpdump may not capture all packets that pass through the interface. – Juliano Oct 26 '09 at 15:45
I got only one rule in POSTROUTING chain and it is under nat table. This rule does the SNAT. I am using Linux 2.6 kernel and I think tcpdump really works great under this kernel. So chance of tcpdump mistake is really negligable – codingfreak Oct 27 '09 at 3:46

I think all you need is (eth0 faces out):

iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE

and of course

echo 1 > /proc/sys/net/ipv4/ip_forward

Coincidence I was playing with this the other day. The above worked, but articles I read sometimes say "this does not handle all traffic" without further explanation.

share|improve this answer
MASQUERADE is intended to be used for dial-up connections. The recommended form of the later command is sysctl -q net.ipv4.ip_forward=1 . – Juliano Oct 26 '09 at 12:47
nah, MASQUERADE is just a lazy form of SNAT were you can't be bothered (or don't know) the external IP address. Nothing wrong with using it. – David Pashley Oct 26 '09 at 13:18
MASQUERADE is the correct option to use when the external IP isn't fixed. – Matt Nov 28 '12 at 3:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.