The packet [cloned through TEE][1], [is set to be untracked by conntrack][2], [prevented from being][3] [duplicated again][4], and emitted through the [local output][5] part of the routing stack. This would be the same if the duplication was done before (eg in mangle or raw PREROUTING) for a routed packet. This makes it difficult (but [not impossible][6]) to receive additional treatment like an additional nat, since it won't be tracked and it's difficult to distinguish it from the original. Here's an example [TRACE][7] (using iptables-legacy's version) capture in a setup similar to OP's of a ping made from 192.168.0.2 to 8.8.8.8: the capture was on the router using `iptables -t raw -A OUTPUT -j TRACE`. The original *routed* packet will not appear since it would have to be captured from raw/PREROUTING, thus validating the explanation above telling it's done from output. TRACE: raw:OUTPUT:policy:2 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1 TRACE: mangle:OUTPUT:policy:1 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1 TRACE: mangle:POSTROUTING:policy:2 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1 [1]: https://elixir.bootlin.com/linux/v4.19/source/net/netfilter/xt_TEE.c#L36 [2]: https://elixir.bootlin.com/linux/v4.19/source/net/ipv4/netfilter/nf_dup_ipv4.c#L72 [3]: https://elixir.bootlin.com/linux/v4.19/source/net/ipv4/netfilter/nf_dup_ipv4.c#L90 [4]: https://elixir.bootlin.com/linux/v4.19/source/net/ipv4/netfilter/nf_dup_ipv4.c#L58 [5]: https://elixir.bootlin.com/linux/v4.19/source/net/ipv4/netfilter/nf_dup_ipv4.c#L91 [6]: https://unix.stackexchange.com/questions/553334/setting-up-udp-packets-to-two-different-destinations-using-iptables-and-prerouti/553707#553707 [7]: https://manpages.debian.org/iptables-extensions.8#TRACE