I'm having trouble using iptables to change the destination address of a broadcast packet. I have read several places that iptables/Linux won't forward broadcast packets, so I'm looking for alternatives.

My network is set up as /30, so broadcast traffic is being sent to me at x.x.x.3. I have tried opening up the subnet on my local machine so that x.x.x.3 is no longer my broadcast address, but the destination MAC address of the packet is ff:ff:ff:ff:ff:ff:xx:xx:xx:xx:xx:xx:xx:xx, so I believe it is still being interpreted as a broadcast packet.

Is there a way to change a packet's destination MAC address?

Are there any tools other than iptables that will perform this operation?

If I can't find a way around this, I'm thinking I would accept this packet locally and write a program that would sent the packet data to the desired recipient. Is there any reason that shouldn't work?


  • Broadcast is only relevant on a single link. What are you trying to do, and why? – Michael Hampton Dec 17 '15 at 21:53
  • @Michael Hampton - I'm using this device to connect two identical networks. I can't change anything with the configuration of the external networks so I'm using two computers to translate and relay packets from one side to the other. Essentially the same thing that's described here. I've got it working fine with the exception of the broadcast packets. – Michael Dec 17 '15 at 22:07

You wish to connect two identical networks. You need to do SNAT and DNAT, so that network A sees network B as having different addresses. But why do you want to forward broadcast packets? If it is to make protocols like SMB and auto-discovery protocols work, then they will probably not work anyway when they get replies from outside the network they were broadcasting to.

If you want to have unique addresses, no NAT, then what you want is called a bridge. Fifteen years ago I did this using OpenBSD. I wanted to insert a firewall between two sets of computers that were in the same subnet. It was easy and worked well. Linux was not capable of that at the time (bridging yes but not with a firewall), today I think it should be possible.


Using a bridge would have worked had I wanted to pass ALL traffic from one interface to another, however, I needed to keep some of the traffic locally.

As far as I can tell, it is impossible to use iptables to forward a broadcast packet. I ended up just writing a program that retransmits received packets on a different interface.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.