iptables DNAT from loopback

Solution 1:

Digging a little deeper reveals some confirmation that aforementioned behavior is totally correct.

According to RFC 5735, network 127.0.0.0/8 should not be routed outside host itself:

127.0.0.0/8 - This block is assigned for use as the Internet host loopback address. A datagram sent by a higher-level protocol to an address anywhere within this block loops back inside the host. This is ordinarily implemented using only 127.0.0.1/32 for loopback. As described in [RFC1122], Section 3.2.1.3, addresses within the entire 127.0.0.0/8 block do not legitimately appear on any network anywhere.

RFC 1700, page 5 also states that these addresses «Should never appear outside a host».

RFC 1812, Section 5.3.7 Martian Address Filtering declares that «router SHOULD NOT forward, except over a loopback interface, any packet that has a source address on network 127», which is exactly my case.

Concerning these references, I presume the case from the first post indeed is a feature, and the opposite behavior would be a standards violation.