Let's assume we have a router which has internal ip( and external ip( and a computer behind the router which has internal ip( And the router has already configured to MASQUARADE source ip so user can access the internet.

And i am wandering when the internet server response user's request with a packet(SRC:>DST: and this packet goes into iptables but no rule have been configured to DNAT it back to user's ip, how does the user even receive the response?

And i've google it someone said it is DNATed automatically by Netfilter, i am wandering if it true or not, and if it is true, when does this Hidden-DNAT performed, is it performed when the packet arrived FILTER table or NAT table or something else? And after it is DNATed will it goes into FILTER's INPUT table or FORWARD table?


Netfilter keeps tracking information on what you send to the MASQUERADE target. When corresponding responses (packets) are received, they are subject to the nat table. The path for incoming packets moving through the nat table is as follows:

1. ingress at router external interface
    a. convert external IP to internal IP
4. egress at router internal interface
5. ingress at internal computer interface

The DNAT is performed in the PREROUTING chain of the nat table. If the original source of the packets was an internal computer on your LAN, the packets will not pass through the filter table of the router because they are recognized as previously NAT'ed packets based on their source and or destination IP's. However, if your router was the original source, and packets are ultimately destined for the router itself, then they would pass through the filter table of the router.

  • Sorry there are two inexact facts: packet will always pass through the filter table. What they won't always do is pass through the nat table. Only the first packet of a flow (seen as [NEW] when running conntrack -E) will pass through the nat table. Then there's a conntrack expectation entry that will short-circuit the nat table for all other packets matching it, because they are considered to be in the same flow. You can also explicitely choose to short-circuit most filter rules for this flow by using -m conntrack --ctstate ESTABLISHED -j ACCEPT in some or all of the filter chains. – A.B Oct 15 '17 at 3:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.