preroute

Preroute, short for PREROUTING, refers to the stage in packet processing where a network packet is examined and possibly modified before the routing decision is made. At this stage, the system has received the packet but has not yet determined its final destination path.

In Linux Netfilter, PREROUTING is a set of hooks that handle packets as soon as they enter the stack, before the routing decision. PREROUTING exists in multiple tables (raw, mangle, and nat), and each serves different purposes. The NAT table’s PREROUTING chain is commonly used for Destination NAT (DNAT), allowing inbound traffic to be redirected to a different host or port. The mangle table’s PREROUTING chain is used for packet alteration such as changing headers or marking packets, and the raw table’s PREROUTING chain can be used to influence connection tracking.

Typical use cases include destination address translation for port forwarding and load balancing, early packet filtering, and header modifications that must occur before routing decisions. For example, a common DNAT rule in iptables might redirect incoming traffic destined for a public IP and port to an internal server: iptables -t nat -A PREROUTING -d example.com -p tcp --dport 80 -j DNAT --to-destination 192.0.2.10:8080.

Prerouting is distinct from the routing decision itself, which occurs after this stage. Changes made in PREROUTING can affect the chosen path or destination, whereas post-routing modifications occur after the routing decision is finalized. In broader networking contexts, preroute concepts are used in policy-based routing and firewall architectures to apply rules before standard routing.