The rule:

-t nat -A OUTPUT -m addrtype --src-type LOCAL --dst-type LOCAL -p tcp --dport 12345 -j DNAT --to-destination ""

Will it loop? Is it well defined? How to avoid the looping (if any)?

My script generates the rule like this (and it would be good to not to have as an exception):

-t nat -A OUTPUT -m addrtype --src-type LOCAL --dst-type LOCAL -p tcp --dport 12345 -j DNAT --to-destination "$addr:12345"

  • I don't know but I don't think the Linux Kernel would fool itself such an easy way. Very interesting question, I'll add it to my favorites indeed. You may also edit the post specifying what's the purpose of such a rule.
    – Marco
    Sep 20 '17 at 12:36

What do you mean "Will it loop"? The rule will be executed more than once?

The rule will not be revisited (re-checked) when it is matched by a packet. So, how is it possible to loop? Also, NAT rules will be checked only at the beginning of connection (connection establishment). Later, all packets will be handled by connection tracking module to apply the same already matched rule.

If you are still in doubt, you can see how many times a rule is matched using:

$ sudo iptables -t nat -L -n -v

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.