1

So I am trying to forward traffic from the internal port 514 to the internal port 55514 over udp (running Ubuntu 19, syslog coming in on 514 from firewall, logstash listening on 55514) It's not happening though. I stripped down and flushed iptables:

sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT
sudo iptables -t nat -F
sudo iptables -t mangle -F
sudo iptables -F
sudo iptables -X

Disabled the firewall:

sudo ufw disable
Firewall stopped and disabled on system startup

IPtables status:

sudo iptables -L

  Chain INPUT (policy ACCEPT)
  target     prot opt source               destination

  Chain FORWARD (policy ACCEPT)
  target     prot opt source               destination

  Chain OUTPUT (policy ACCEPT)
  target     prot opt source               destination

Traffic is definitely coming in through port 514:

sudo tcpdump -u -i eno1 port 514

  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes
  13:04:49.898982 IP _gateway.syslog > elktest.syslog: SYSLOG user.warning, length: 70
  13:04:50.429960 IP _gateway.syslog > elktest.syslog: SYSLOG user.warning, length: 70
  13:04:50.961035 IP _gateway.syslog > elktest.syslog: SYSLOG user.warning, length: 70
  13:04:51.164793 IP _gateway.syslog > elktest.syslog: SYSLOG local0.info, length: 185
  13:04:51.491999 IP _gateway.syslog > elktest.syslog: SYSLOG user.warning, length: 70

I applied these rules:

sudo iptables -I FORWARD -i eno1 -p udp -d 192.168.50.225 --dport 514 -j ACCEPT
sudo iptables -I FORWARD -i eno1 -p tcp -d 192.168.50.225 --dport 514 -j ACCEPT
sudo iptables -t nat -I PREROUTING -i eno1 -p udp --dport 514 -j DNAT --to-destination 192.168.50.225:55514
sudo iptables -t nat -I PREROUTING -i eno1 -p tcp --dport 514 -j DNAT --to-destination 192.168.50.225:55514

And yet, when I listen to the desired port (55514):

sudo tcpdump -u -i eno1 port 55514

  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes
  **crickets**

I get absolutely nothing. Any advice, comments that you can give me are appreciated. Please help.

  • Your post is good, but it would be useful to add what systems) you are doing the dumps on - ie source, router or target in each case. – davidgo Jun 12 at 19:55
  • Is 192.168.50.225 the same machine? Check the loopback interface sudo tcpdump -u -i lo port 55514. I am not positive where you would intercept this traffic if it is the same machine because linux gets clever in taking shortcuts when a traffic's destination is local. – Andy Jun 12 at 19:57
  • Sorry yes that (192.168.50.225) is the machine's local IP. – johnbchron Jun 12 at 19:58
  • Thanks so much @davidgo and @Andy, it was working the whole time! sudo tcpdump -u -i lo port 55514 did the trick! – johnbchron Jun 12 at 20:00
1

I've not tried it, but I posit that the immediate problem is the tcpdump command - specifically the input is still coming in destined for 514 - not 55514 and this can't be changed on the router as its an input.

I would try monitoring both the input and output on 514 and 55514 and seeing the response.

  • How do I monitor the output of a port? Does tcpdump monitor the input or the output? – johnbchron Jun 12 at 19:55
  • 1
    tcpdump appears to me to monitor the interface. What happens if you replace -i eno1 with -i any (ie so you are monitoring the input and output interface) – davidgo Jun 12 at 19:58
  • Okay a reboot later it's not forwarding anymore. I checked iptables and all the rules are still there... I don't know what's going on – johnbchron Jun 12 at 21:12
  • That should probably be posted as anothwr question. Are the rules in the correctorder? Rules are interpreted from to to bottom, woth +I inserting at the top and -A appending to the bottom. Also, is ip_forwardimg set? – davidgo Jun 12 at 21:15
  • What is ip_forwarding? (if this doesn't fix it I'll make a new question) – johnbchron Jun 12 at 21:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.