The Ghost in the Subnet: Unpacking iptables-mod-randmap

How an experimental kernel module bypasses connection tracking to turn a single server into a shapeshifting network prefix.

6 min read · apernet/iptables-mod-randmap

A single server rack emitting a chaotic swarm of floating IP addresses. This illustrates the concept of mapping one machine to a randomized prefix. — A single physical server maps to an unpredictable, randomized network prefix.

Key Takeaways

iptables-mod-randmap bypasses the Linux conntrack system entirely to execute stateless NAT and randomize source and destination IPs on a per-packet basis.
To survive without state, the module ships with a custom fork of the kernel's NAT protocol code to manually forge Layer 4 checksums.
The architecture trades memory efficiency for CPU overhead, taxing the kernel's entropy pool by calling get_random_bytes for every processed packet.

The Memory Trap

Standard Network Address Translation is fundamentally stateful. A router must remember how it altered an outgoing packet so it can reverse the math for the incoming reply. This state lives in the Linux conntrack table.

At scale, tracking millions of connections consumes massive amounts of memory. Under adversarial conditions, a full conntrack table means dropped packets and a degraded network. iptables-mod-randmap throws out this basic rule of networking entirely.

It modifies source and destination IPs on a per-packet basis using raw kernel entropy. By completely bypassing the conntrack system, it creates a stateless routing environment where memory usage remains flat regardless of connection volume.

Standard NAT relies on connection tracking memory, while RANDMAP uses symmetric bitmasks to achieve stateless routing.

Forging the Checksums

The hardest part of stateless NAT is not changing the IP address. Changing an IP address invalidates the TCP and UDP checksums. Because RANDMAP operates outside the standard stateful NAT pipeline, it cannot rely on the kernel to fix these packets automatically.

The module solves this by shipping a custom fork of the Linux kernel's nf_nat_proto.c file. This fork is deliberately stripped of its stateful dependencies. It manually recalculates Layer 4 checksums using precise bitwise math to ensure the receiving end does not drop the packet as corrupt.

// Simplified conceptual representation of the core bitwise mask application
new_addr = (get_random_u32() & ~mask) | (network_prefix & mask);

A modern robotic arm rapidly shifting the beads of a traditional wooden abacus. This represents the manual, high-speed recalculation of layer 4 checksums. — Manual checksum recalculation requires precise, high-speed bitwise math outside the standard kernel pipeline.

The Entropy Tax

Stateless randomization has a severe cost. To randomize every single packet, the module must hit the kernel's entropy pool millions of times per second. Calling get_random_bytes directly in the packet processing path is a bold architectural choice.

At 10Gbps throughput, generating random numbers for every packet becomes the primary bottleneck. It is a pure engineering trade-off that sacrifices compute cycles to preserve baseline memory.

A mechanical hopper dropping dice onto identical parcels moving on a high-speed conveyor belt. This represents the computational tax of generating entropy for every network packet. — Calling get_random_bytes on every single packet in a high-throughput stream shifts the bottleneck from memory to CPU.

The Legacy Application

Writing a bespoke C module for iptables is increasingly rare in the modern Linux networking landscape. Today, eBPF and XDP offer safer, highly performant alternatives for packet manipulation without risking kernel panics.

Yet iptables-mod-randmap exists because it plugs directly into legacy routing tables. It provides extreme stateless manipulation where modern replacements might require rewriting the entire networking stack from scratch.

Feature	iptables-mod-randmap	Standard NAT	eBPF / XDP
State Management	Stateless	Stateful (conntrack)	Programmable
Memory Overhead	Near Zero	High (per connection)	Variable
CPU Overhead	High (Entropy tax)	Low	Extremely Low
Kernel Risk	High (C Module)	Safe (Built-in)	Safe (Verified)