iptables REDIRECT works only for first packet
nat table rules always work only for first packet in connection. Subsequent packets of same connection never traverse nat rule list and only supported by conntrack code
As UDP is connectionless in nature, "connection" here is defined simply by addresses, ports and timeout. So, if second UDP packet with same source port and address and same destination port and address arrives within the timeout, Linux believes it belongs to established "connection" and doensn't evaluate nat rule table for it at all, reusing verdict issued for previous packet.
See here: http://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO-3.html
This is caused by the fact that iptables applies connection tracking on PREROUTING
chain. Whenever a new connection is made, iptables will consult the conntrack cache. If a match was found, no rule will be applied from nat table.
If you want to disable change this behavior, look at NOTRACK
target in raw table.
Please, note that this applies even for UDP (which is a connection-less protocol). The first packet is considered as opening connection NEW
and the other is a reply ESTABLISHED
.
I found a related post on serverfault.