I am running a simple expirement for validating some NAT concepts with IPtables.

I have a Firewall with two interfaces connecting two networks:

Network A - - connected to eth0 - Firewall's IP:
Network B - - connected to eth1 - Firewall's IP:

I've applied the following DNAT rule to the FW:

iptables -t nat -A PREROUTING -d -j DNAT --to-destination

Traffic gets redirected properly to the host, this is a sample captured from the .0.2 host:

16:17:40.005055 IP > ICMP echo request, id 15106, seq 1285, length 64 16:17:40.005133 IP > ICMP echo reply, id 15106, seq 1285, length 64

However I see something very interesting when I capture this same traffic from the FW HOST.

When I capture it from eth0 I see the traffic as expected, echo replys are coming with the IP:

But when I do the same thing for eth1, this is what I see:

16:21:44.348196 IP > ICMP echo request, id 15106, seq 1527, length 64 16:21:44.360376 IP > ICMP echo reply, id 15106, seq 1527, length 64

If you pay attention to the echo reply, the source IP is How that is possible if we just saw the original packages from when we looked at eth0?

As one can see, there is no SNAT or Masquerade rule configured on the FW:

FIREWALL:~# iptables -t nat -L

Chain PREROUTING (policy ACCEPT) target     prot opt source           
destination          DNAT       all  --  anywhere            to: 

Chain POSTROUTING (policy ACCEPT) target     prot opt source          

Chain OUTPUT (policy ACCEPT) target     prot opt source              

There is only the original DNAT rule.

So why is the kernel masquerading my packages? I know that is is advisable to do SNAT in conjunction to DNAT, but that is no my point. I want to understand why that is happening if I did not tell the IPtables to do so. Is it possible that the kernel does that without consulting iptables/netfilter rules?

  • What is your default gateway? route -n Is a host? Perhaps you are getting a response from
    – Tim
    Aug 14, 2018 at 17:41
  • Yes, is the Firewall's IP. is gateway for network B and is gateway for network A. Both IPs belongs to the FW. Aug 14, 2018 at 19:02

1 Answer 1


That is the effect of your DNAT rule. You want the address changed, so on one side you have the original packets and on the other side you have the changed packets. That is the whole point of NAT.


From the manual

It specifies that the destination address of the packet should be modified (and all future packets in this connection will also be mangled)

That means that not just the package starting the connection will be modified, but also all responses, and all further packets sent.

  • Right, but DNAT is for Destination address translation right? I am ok with that, but why the Source address from the reply packets are translated too? What is the relation between DNAT and Source Addresses? Aug 14, 2018 at 19:48
  • It is the source address of the ICMP reply that is modified, together with the destination address for the request, that you didn't highlight. DNAT changes the destination of the request. As the source of the reply is the destination of the request, It must also change the source of the reply. The original sender expects a reply from the original destination.
    – RalfFriedl
    Aug 14, 2018 at 19:54
  • Right I agree that the 'original sender expects a reply from the original destination', that is why I thought I had to configure a SNAT rule for each DNAT rule I have, in order to meet sender's expectation. I read that in some places like: thewiringcloset.wordpress.com/2013/03/27/… But, from what you are telling me, the DNAT rule is enough by itself? It does not need an auxiliary SNAT rule for the response traffic? Aug 14, 2018 at 20:28
  • One DNAT is enough to handle everything. The link you refer to is nonsense. It may still work with the additional SNAT, but it is not necessary.
    – RalfFriedl
    Aug 14, 2018 at 20:35
  • Right, I am glad I will teach the right thing to my students on today's class about Iptables. Thanks for your time and contribution sir. Aug 14, 2018 at 20:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.