Skip to main content
Unix & Linux

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

13
  • The important keyword is conntrack. And iptables doesn't "add any implicit rules", it's just that established connections get special treatment. I have no idea about official references (kernel source code?), but the effect is easy to test. Commented Nov 15, 2017 at 22:56
  • @dirkt From the perspective of the filter table it seems like there are implicit rules here, no? Established connections aren't automatically allowed through there, right? Or am I really missing something? Commented Nov 15, 2017 at 23:37
  • 2
    @daisy I'm pretty sure that's not what masquerading is. Masquerading is similar to (or a type of) SNAT. The SNAT target requires the rule to specify an IP address whereas the MASQUERADE target accepts an interface (see Difference between SNAT and Masquerade). But what I'm asking about applies to DNAT as well, and there's definitely no masquerading going on there (see SNAT vs. DNAT vs. Masquerading). Commented Nov 16, 2017 at 7:45
  • 2
    Note, you can see the currently tracked connections with sudo conntrack -L (package conntrack-tools). Commented Nov 16, 2017 at 14:08
  • 1
    @CliffArmstrong In this context, DNAT stands for Destination NAT (see en.wikipedia.org/wiki/Network_address_translation#DNAT). It doesn't seem like DNAT and masquerading are two names for the same thing. For a general discussion, see the link in my previous comment - or this one: serverfault.com/questions/119365/…. Also see the Netfilter documentation: There is a specialized case of Source NAT called masquerading Commented Aug 11, 2019 at 12:51