I need to establish a TCP connection where the client is spoofing its IP for all outgoing traffic. My first attempt was to add a rule to the POSTROUTING chain like so:

iptables -t nat -A POSTROUTING -p tcp --dport 5555 -j SNAT --to-source

This works for the SYN packet, but does not catch and rewrite the ACK coming from the client. My understanding is that this is because the ACK only passes through the OUTPUT chain, never hitting POSTROUTING. My next attempt was to use xtables-addons and do raw SNAT like so:

iptables -t raw -A OUTPUT -p tcp --dport 5555 -j RAWSNAT --to-source

iptables gives me an error on this command based on the target. I believe it is based on the target because -j DROP and -j ACCEPT both work. The man page specifically says that RAWSNAT is valid in the OUTPUT chain and I have verified that the xt_nat.ko module is loaded....

Does anyone have insight into what is going on with RAWSNAT or have a way to get ALL of the outgoing connection traffic to pass through the POSTROUTING chain in the nat table? I have not been able to figure out if MARK or CONNMARK can help me here based on the documentation I have read.

  • Not sure what exactly your use case is, but "spoofing IPs for local applications" probably doesn't work this way. NAT can't arbitrarily rewrite stuff (though I wish it could). Consider using a network namespace, either for the applications; or for the masquerading process, and send everything through it. And I've also read that SNAT used to work in the OUTPUT chain, but I have the impression it doesn't anymore. – dirkt Jul 27 '18 at 6:07

I have the same issue and I found the link https://github.com/nawawi/xtables-addons/commit/9414a5df343bf30ba13e76dbd7181c55683b11cb. Since 2013, the RAWSNAT/RAWDNAT extension has been removed from xtables-addons.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.