I have the following situation:
sudo iptables \ --table nat \ --append PREROUTING \ --protocol ALL \ --destination 192.168.100.3 \ --jump DNAT \ --to-destination 192.168.100.4 # some other machine in my local network sudo iptables \ --table nat \ --append POSTROUTING \ --protocol ALL \ --destination 192.168.100.4 \ --jump SNAT \ --to-source 192.168.100.3
The ongoing ssh connection remains and I don't get disconnected. However if I open a new terminal on the host and try going
ssh email@example.com I actually connect with the other machine in my network, to which I forwarded using iptables (192.168.100.4). Why does my first connection remain and not get disconnected? From my understanding the rules I specified should forward ALL packets to the ip 192.168.100.4 and yet it is not the case.
nat table is traversed only by the first packet of the connection. It defines all the translations and these are recorded in the connection tracking table. Subsequent packets don't traverse the
nat table at all, instead the connection tracker just takes the recorded translation parameters from its table and applies them.
nat rules that appeared after the connection was established never apply to the already running connections. The previous connection in your case knows there were no translation rules defined, so it does no translation. If you now connect to another computer and remove
nat rules, the connection will be kept, but new connections will be created again without translation.