NAT到127.0.0.1的数据包为何被丢弃

Add a filter rule:
iptables -t nat -I PREROUTING 2000 -p icmp -j DNAT --to-destination 127.0.0.1

Ping this host, the packets are dropped.

Debug steps:
1. cat /proc/net/nf_conntrack
Nothing is shown.

2. conntrack -E
No conntrack event

3. cat cat /proc/net/stat/ip_conntrack

No clue

4. cat net/stat/rt_cache
00000005  00000124 00000064 00000000 00000000 00000002 00000042 00000000  00000004 00000005 00000000 00000000 00000000 00000000 00000000 00000001 00000000
00000042 is in_martian_dst. Review the function ip_route_input_slow() we can see that the packets are dropped through
if (ipv4_is_lbcast(daddr) || ipv4_is_zeronet(daddr) ||
    ipv4_is_loopback(daddr))
    goto martian_destination;
...
martian_destination:
    RT_CACHE_STAT_INC(in_martian_dst);


The document: 专家们公认的20个最危险的安全漏洞 shows why those packets should be dropped.