Re: Forwarding packets over the same LAN

[Pascal Hambourg <pascal.mail@plouf.fr.eu.org>]

Hello,

Simion Onea a écrit :
> 
> I tried these rules but it seems that packets to not pass the first
> rule. To test this I put two LOG targets before and after the PREROUTING
> rule like this:
> 
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10025 -j LOG
> --log-tcp-options --log-prefix PREROUTING_before:
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 10025 -j DNAT
> --to-destination 172.20.1.254:25
> iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25 -j LOG
> --log-tcp-options --log-prefix PREROUTING_after:
> iptables -t nat -A POSTROUTING -o eth0 -p tcp -d 172.20.1.254 --dport 25
> -j SNAT --to-source 172.20.1.245
> 
> As a result I received in the log three messages with
> "PREROUTING_before" -- these were SYN packets. And no message with
> "PREROUTING_after" :-(
> 
> What could be wrong ?

man iptables
DNAT is a terminal target, so after a match the next rules in the chain 
are not examined.