I have a program send UDP packets to, receive packets at port 54321, and it uses IP address. I want it send packets to with same port, because this program and remote server only accept 12345 & 54321. This is topo: enter image description here

At first, I use iptables prerouting:

iptables -t nat -A PREROUTING -s -p udp --dport 12345 -j DNAT --to

But it does not work, I used LOG, find the nat never happened( & does not need routing?):

iptables -t nat -A PREROUTING -s -p udp --dport 12345 -j LOG

Then I find these packets can find in the INPUT chain:

iptables -A INPUT -s -p udp --dport 12345 -j LOG

Is there any way to use DNAT if only I can see these packets in the INPUT?

BTW, I can use socat to redirect these packets, but can not lock ports on 12345 & 54321 on the server side:


Some updates from my side, I can use phydev to nat packets now:

iptables -t nat -A PREROUTING -m physdev --physdev-in tap0 -s -p udp --dport 12345 -j DNAT --to

From tcpdump of eth0, I can see packets from to ( can not use in my network)

tcpdump -n -i eth0 host 
12:36:22.250548 IP > UDP, length 16

However, I can not see these packets from server... Then I run tcpdump on the remote server, I can see these packets:

21:55:44.980988 IP > UDP, length 16

But can not used in my lab network, it's dropped.

So the remaining thing become: how to DNAT one packet then SNAT the same packet...

2 Answers 2


I fixed this issue by run command

conntrack -F

After all of my iptables rules. There is no need to use --phydev, just using following two rules:

iptables -t nat -A PREROUTING -s -d -p udp --dport 12345 -j DNAT --to
iptables -t nat -A POSTROUTING -d -o eth0 -j SNAT --to-source

To perform DNAT of locally generated packets one should use OUTPUT chain of NAT table, not the PREROUTING chain.

Your rule should likely look:

iptables -t nat -A OUTPUT -s -p udp --dport 12345 -j DNAT --to
  • This rule does not work... tcpdump can not show anything, I used PREROUTING with -m physdev --physdev-in tap0 can DNAT packets, but it sometimes does not work, not sure if it's related to conntrack. Sep 21, 2020 at 7:15
  • Do you have a route on which points back to &
    – Tomek
    Sep 21, 2020 at 15:00
  • No such route existed Sep 22, 2020 at 1:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .