I'm trying to learn about iptables and port forwarding and I'm running into a very simple hurdle. If my understanding is correct, this concept applies when there is a local area network, a router, and some larger outer network, typically the internet (I'm actually trying to implement this on an entirely local network with no internet access, but I think the general concepts still work). When a packet from the outer network is sent to one of the computers on that local network, the router intercepts it and forwards it to the correct device. My question is this: the router has its own IP address, and the packet wants to go to a different device with a different IP address. So how does the router actually intercept that packet if the packet isn't destined for the router itself?

I hope this question makes sense. This question or something similar may have been asked before, but I wasn't sure what words to use to search for it.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25, 2018 at 9:07

3 Answers 3


A router doesn't intercept packets. A node requiring a gateway to a distant network passes those IP packets to that gateway/router (most often using MAC addressing in the encapsulating frame) and the router forwards them according to its local routing table.

Whether or not the router and subsequently the network has Internet connectivity doesn't matter.

For details on how IP and MAC addressing are related check this question.


The level 2 is used in an local area network (LAN). Your devices has a default gateway (or specific routes) configure on it (configured manually or by some DHCP).

Gateway explanation

When your PCs want to reach an IP that is not in the same LAN they will use the default gateway configure on it. Then the packet will have the MAC of the router (R1) as the destination MAC (learned with ARP). The switch (working at level 2) will forward this packet to the router (here the router R1), the router will check the IP destination and then forward to the appropriate device and so on.

On Linux you can check the routes (and the default route) with the command ip route and your arp table with the command arp.


Internet is an interconnection of (tons) of LAN.

There is no black magic, all of the devices has to be configured (manually or automatically) to know what to do when they try to communicate with other devices. There is always lot of work to make this transparent to end users (DHCP, routes of gateway, ...). ;)


The router doesn't really intercept packets. A router will get a frame, strip off the frame to inspect the packet, then route the packet based on the destination address of the packet, based on what is in its routing table (dropping any packet for which is has no destination). The router will build a new frame for the packet for the network type to which the packet is being routed.

Routers route packets between networks, so a router will have at least two networks attached to it, but it may have many networks, and it may route packets between all the attached networks.


Based on your comment, you are interested in how a packet gets to a router in the first place.

Routers get packets from the frames sent to them. That could be from a broadcast or multicast, but a router will not normally propagate those. If it is a unicast, then it was sent directly to the router form another source. That is usually the source host or another router.

A host wanting to send a packet to a different host will mask its (the source) address and the destination address with its network mask. If the results are equal, then the destination is on the same network, and the frame for the packet is built with the destination host as the frame destination. If they are not equal, then the host knows that the destination is on a different network, and it builds the frame with its configured gateway (router) as the frame destination.

The router will strip off the frame to get the packet and read the packet destination in order to route the packet to the next leg of its journey.

It seems your question may be confusing routing and NAT. Those are really two completely different things. NAT (Network Address Translation) is changing the IPv4 address (source, destination, or both) on a packet. A router or firewall may be a convenient place to NAT (if you need NAT), but it is not a requirement of routing. NAT is used if you need to use private addressing on your network for traffic to communicate on the public Internet, or you need to communicate with a network that has addressing that overlaps your network addressing. Because NAT breaks many protocols, you should only use it if you must use it to overcome a problem.

  • Thanks for your response. Maybe intercept wasn't the right word, but how does the packet actually reach the router if it is intended to go somewhere else? Must the device sending the packet know that the packet will pass through a router? In my implementation I was trying to insert a router between two devices and forward or drop packets without those two devices necessarily being aware that their packets are passing through a router.
    – nkr
    Jul 20, 2018 at 13:39
  • A host knows if a destination is on its own network or not. If not, it sends a frame with the packet to its configured gateway, which is usually a router. Routers have routing tables telling them how to route packets, and the router may have another router as the next hop in the path of a packet. Eventually, the packet will get to a router with the destination network, and that router will place a frame with the packet on the destination network.
    – Ron Maupin
    Jul 20, 2018 at 13:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.