How to change destination IP address after routing decision was made, i.e. in POSTROUTING chain of iptables?
I don't think there's a good answer for this. I don't think iptables lets you change the destination IP address after routing. What I want to do is:
iptables -t nat -A POSTROUTING -o eth0 -p udp -d 10.0.0.0/8 --dport 53 -m comment --comment "Redirect DNS when VPN is down" -j DNAT --to-destination 126.96.36.199
But that isn't legal. I want to change the destination address based on the output interface, which isn't known until after routing.
If you could change the destination IP address, it would be too late to change the routing (which would be fine for my example use). You only get to route packets once.
The only solution I'm aware of would be to have a virtual machine that sits between eth0 and the real network which could then do DNAT.
For my purposes, I can dynamically add or remove a prerouting rule when the VPN interface goes down or comes up, but it feels like a clumsy solution.
There is no way to change destination ip in
POSTROUTING chain will act as
SNAT for whole mapping network.
iptables -t nat -A POSTROUTING -s 188.8.131.52/24 -d 184.108.40.206/24 -j NETMAP --to 220.127.116.11/24
The above rule will make replacement of source ip addresses