I have a service running on a particular port, but in order to make it accessible via a more memorable port as well as the normal port, I added an iptables rule that acts as a port alias:
iptables -A PREROUTING -i eth0 -p tcp -m tcp --dport 5555 -j REDIRECT --to-ports [configured port]
Perhaps I was a bit naive, but I actually started by adding a second rule in POSTROUTING that remapped the TCP source port to be the aliased port in outgoing traffic. However, it turns out I didn't need that rule at all. So, my question is: why does it work using only thing single rule?
The client makes the connection to host:alias port. Since there's no rule in iptables to remap the source port for this service's outgoing traffic, it would receive a response from the host, but with a different source port. Wouldn't this cause TCP conversation mapping issues with the client? By that I mean, the client is expecting a response from host:alias port, but would instead (theoretically) get a response from host:real port. And since the traffic wouldn't be considered "related," it shouldn't even make it through a NAT or other stateful firewall -- yet it does. Is there some magic that happens in iptables that sees the incoming prerouting rule and then automatically adjusts outgoing traffic to this rule as well?