Tag Info

Hot answers tagged


It may seem counter-intuitive but only packets that conntrack doesn't know about go through the NAT table. This makes attempting to use string matching problematic for NATing: by the time the string appears in a packet the connection is already established. Usually using iptables string matching is ill-advised and you should do something at a higher layer ...

Only top voted, non community-wiki answers of a minimum length are eligible