I was reading Rusty Russell's NAT Howto when I came across this section:
6.2. Destination NAT
This is done in the PREROUTING chain, just as the packet comes in;
this means that anything else on the Linux box itself (routing, packet
filtering) will see the packet going to its `real' destination.
My understanding of what he means by real destination is the original destination of the packet, prior to being altered by a rule on the PREROUTING chain, which is slightly perturbing because my previous understanding was the opposite - i.e. that subsequent rules see the DNAT'd destination, not the original. By logging the FORWARD chain of a local VM I think that I'm right, because I can see the DNAT'd IP in the DST field.
So, my question is, what does Rusty mean here? I'm considering writing to Rusty to point out that this wording is unclear, it's open to interpretation what the real IP is.