Networking & Firewall (Ss/Netstat/Iptables/Nftables/Curl)

Stop wasting time tracing connections through NAT hell

🧩 The Challenge

Dealing with a service that refuses to talk to an internal endpoint because of a mangled NAT rule is pure misery. I’ve spent entire afternoons staring at packet dumps just to realize a single port forward was hitting the wrong interface.

💡 The Fix

Use the conntrack utility to peek at the kernel’s connection tracking table instead of guessing where your packets are dying. It’s the fastest way to see the original and translated state of a connection in real-time.

conntrack -L -p tcp --dport 80

⚙️ Why It Works

This command forces the kernel to dump the active entries in the connection tracker that match your specific destination port. It shows you the actual source, destination, and the translated address so you can see exactly where the address translation is breaking down.

🚀 Pro-Tip: Pipe it into grep for the specific remote IP if you’re trying to debug a connection coming from a busy load balancer.

Linux Tips & Tricks | © ngelinux.com | 8/24/2026