How to change destination IP address after routing decision was made, i.e. in POSTROUTING chain of iptables?


4 Answers 4


e... as the name suggests - it is a bit too late to do it in the POSTROUTING table.

this and this are quite helpful to see what/when happens. if you really have to dst address rewrite - maybe put another machine in the line [ virtual ? ] or even better - rethink why would you want to do that.


If you really want to change the destination in POSTROUTING, perhaps you can try abusing the NETMAP target? I'm not sure if it works, but try something like:

iptables -t nat -A POSTROUTING -d -j NETMAP --to=

I don't think there's a good answer for this. I don't think iptables lets you change the destination IP address after routing. What I want to do is:

iptables -t nat -A POSTROUTING -o eth0 -p udp -d --dport 53 -m comment --comment "Redirect DNS when VPN is down" -j DNAT --to-destination

But that isn't legal. I want to change the destination address based on the output interface, which isn't known until after routing.

If you could change the destination IP address, it would be too late to change the routing (which would be fine for my example use). You only get to route packets once.

The only solution I'm aware of would be to have a virtual machine that sits between eth0 and the real network which could then do DNAT.

For my purposes, I can dynamically add or remove a prerouting rule when the VPN interface goes down or comes up, but it feels like a clumsy solution.


There is no way to change destination ip in POSTROUTING table.

Using NETMAP in POSTROUTING chain will act as SNAT for whole mapping network.


iptables -t nat -A POSTROUTING -s -d -j NETMAP --to

The above rule will make replacement of source ip addresses to in 24 network.

You must log in to answer this question.