In my linux box, i got two UDP apps binded on port 46000 (App A) and 36000(App B) respectively. The apps communicate with two UDP servers bindeded as (Srv X) and (Srv Y) respectively.

When i send the packet out i have a requirement to always use UDP src port as 36000. The packet on wire will be always 36000 - 36000 src and dst ports.

My iptables rules are like below. My intention is to DNAT the incoming packet from Srv X from port 36000 to 46000 so that App A receives it.

-A PREROUTING -s -p udp --dport 36000 -j DNAT --to-destination :46000

-A PREROUTING -p udp --dport 36000 -j CT --notrack
-A OUTPUT -p udp --dport 36000 -j CT --notrack
-A OUTPUT -p udp -j ACCEPT


-A INPUT -p udp -m udp --dport 36000 -j ACCEPT --> rule 1
-A INPUT -p udp -m udp --dport 46000 -j ACCEPT --> rule 2
-A OUTPUT -p udp -m udp --dport 36000 -j ACCEPT -> rule 3

When i send a packet out from App A to Srv X it goes fine. There is no conntrack entry in /proc/net/ip_conntrack and OUT packet matches rule 3. When the response comes from Srv X to App A, the packet traverses raw table but it DOES NOT undergo DNAT and directly jumps to filter table rule 1. This means Srv X response comes to my box but it goes to App B instead of App A.


  1. RAW table indicates there is no CONNTRACK. However, the above behaviour indicates the first packet App A -> Srv X with src and dst port as 36000 - 36000 is being tracked by some module somewhere. Hence the response from Srv X -> App A does not seem to undergo DNAT. How do i avoid this CONNTRACK?

  2. How to ensure every incoming packet from Srv X with dst port 36000 always undergoes DNAT?

Thanks in advance, Telex

  • There used to be a RAWDNAT and RAWSNAT target in xtables-addons. Now I believe their functionality has been absorbed by DNETMAP. Jul 29, 2015 at 13:10
  • No, sorry, DNETMAP still uses conntrack. Jul 29, 2015 at 13:25

1 Answer 1


By looking at the Netfilter documentation, it is said that "Connection tracking is fundamental to NAT", hence you cannot have DNAT without enabling conntrack.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .