1

I want to drop certain packet destined to an ip_address AFTER it has reached the POSTROUTING chain. However, for iptables, the "nat" table cannot be used for filtering so the following doesn't work:

iptables -t nat -A POSTROUTING -d ip_address -j DROP

So is any way to do this? If iptables cannot do it, are there any alternatives? Please advise. Thank you.

Improve this question

1 Answer 1

Reset to default
10

Routing is complete immediately before the postrouting chains execute (thus the name).

The way you want to accomplish whatever task you are trying to accomplish, I think, is not the right way because it is impossible. However, any reasonable filtering predicates will generally be extant before postrouting. You should be able to apply the same filter criteria which would otherwise cause the change in postrouting you want to filter on to a forward or output rule.

See this diagram for how packets flow through iptables:

enter image description here

This excellent diagram is still maintained sometimes, and comes from http://xkr47.outerspace.dyndns.org/netfilter/packet_flow/.

Improve this answer
2
  • Do you have a link to where this diagram was originally posted? I've seen it elsewhere before, but right now this answer has more Google juice than the original author's prior version.
    – Charles Duffy
    Jul 6, 2015 at 16:53
  • Updated with it!
    – Falcon Momot
    Jul 6, 2015 at 21:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .