Dnat

When deploying jump hosts, transparent proxies, or network bridges across multi-homed Linux systems, standard routing tables are often insufficient. Using the Linux Netfilter framework via iptables, you can manipulate packets at both ingress (PREROUTING) and egress (POSTROUTING). Scenario 1: Basic Traffic Forwarding via DNAT and MASQUERADE In this setup, our Linux server acts as an intermediary bridge forwarding traffic from a client to a remote backend service: Client Source IP: 198.51.100.12 Intermediary Gateway (Our Server): 203.0.113.30 Final Backend Destination: 192.0.2.84 Client [198.51.100.12] ──► Gateway [203.0.113.30] ──► Backend [192.0.2.84] Step 1: Destination NAT in PREROUTING Intercept incoming packets destined for our gateway and rewrite the destination IP before routing lookup occurs: ...

In honeypot deployments, captive portals, or specialized traffic inspection environments, administrators often need to forward all incoming traffic—regardless of destination port—to a single listening service (such as an HTTP inspection proxy or logging daemon). This can be accomplished at line rate within the Linux kernel using Netfilter Destination NAT (DNAT) via iptables. Redirecting Inbound Port Ranges via DNAT To redirect all incoming TCP traffic across ports 1 through 65535 arriving on interface eth0 to an internal service listening on port 80 at 192.168.1.10: ...