how to DNAT packet decrypted by ipsec. encrypted packet is: sourceIP: destIP

If i simply :

 iptables -t nat -A PREROUTING  d -j DNAT --to-destination

it doesnt work - it seems that prerouting is doing nat on encrypted traffic - how to force it to work after decryption ?

1 Answer 1


Tell your rule only to match traffic that's been through the ipsec decrypt-and-verify step:

iptables -t nat -A PREROUTING -d -m policy --pol ipsec --dir in -j DNAT --to-destination
  • hmm - i have an error: Cannot use -X with A
    – Kriss
    Oct 20, 2014 at 11:58
  • What line did you enter? I see no -X above!
    – MadHatter
    Oct 20, 2014 at 12:03
  • i have entered: iptables -t nat -A PREROUTING -d --pol ipsec --dir in -j DNAT --to-destination and got an error: iptables v1.4.14: Cannot use -X with -A
    – Kriss
    Oct 20, 2014 at 12:08
  • Weird, me too. Never seen that before. Try the above, which doesn't throw the same error.
    – MadHatter
    Oct 20, 2014 at 12:41
  • i have changet it to iptables -t nat -A PREROUTING -d --match policy --pol ipsec --dir in -j DNAT --to-destination and no error but i am not sure if it works correctly
    – Kriss
    Oct 20, 2014 at 12:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.