Display the Natted / Routed Connections on a Linux Iptable Firewall

by on February 26, 2008 · 4 comments· LAST UPDATED February 26, 2008

in , ,

Q. I've Linux box acting as software router (natted) for over 100 computer connected via LAN. Regular netstat command is not displaying the list of all natted connections. How do I find out connections managed by netfilter / iptables which comes with the Debian 4.x system?

A. You cannot use regular netstat command to display NAT connections managed by iptables. You need to use netstat-nat command. You can also use /proc/net/ip_conntrack or /proc/net/nf_conntrack, which is the temporary conntrack storage of netfilter.

Install netstat-nat

Use apt-get command under Debian / Ubuntu Linux, enter:
$ sudo apt-get install netstat-nat

Source code / RPM file

If you are using Suse / Redhat Linux, grab source code or RPM file here:

How do I use netstat-nat command?

Login as root user and type the following to display list of all natted connections:
# netstat-nat -n
To display NAT connections with protocol selection, enter:
# netstat-nat -np
To display all connection by source IP called 192.168.1.100
# netstat-nat -s 192.168.1.100
To display all connections by destination IP/hostname called laptop, enter:
# netstat-nat -s laptop
To display SNAT connections, enter:
# netstat-nat -S
To display DNAT connections, enter:
# netstat-nat -D
To display only connections to NAT box self i.e. doesn’t show SNAT & DNAT, enter:
# netstat-nat -L
To display help, enter:
$ netstat-nat -h
$ man netstat-nat

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 4 comments… read them below or add one }

1 Aaron Conaway February 26, 2008 at 1:07 pm

I’ve been using iptstate at home to look at connections, but it’s more like top for network connections through IPTables.

netstat-nat is a lot more flexible — especially when I have people over who are IMing and surfing all over the place.

Thanks for the info.

Reply

2 Balazs Zachar May 18, 2011 at 6:38 pm

You can use the conntrack command as well (in fedora it is in the conntrack-tools package ).
It has a nice feature to watch the events in “real-time”…

Reply

3 Charles Kozler August 15, 2011 at 12:58 pm

Just as a side note you may want to make a note that the kernel must have netfilter enabled or loaded as a module

Reply

4 9laz March 12, 2013 at 10:31 am

I like tool: iptstate – display realtime connection/nat state, can filter output by IP (src/dst) and port and run in text mode / console.

Reply

Leave a Comment

Tagged as: , , , , , , , , , , , , , ,

Previous Faq:

Next Faq: