2

In my linux box 10.20.1.1, i got two UDP apps binded on port 46000 (App A) and 36000(App B) respectively. The apps communicate with two UDP servers bindeded as 10.10.1.1:36000 (Srv X) and 10.10.1.2:36000 (Srv Y) respectively.

When i send the packet out i have a requirement to always use UDP src port as 36000. The packet on wire will be always 36000 - 36000 src and dst ports.

My iptables rules are like below. My intention is to DNAT the incoming packet from Srv X from port 36000 to 46000 so that App A receives it.

*nat
-A PREROUTING -s 10.10.1.1/32 -p udp --dport 36000 -j DNAT --to-destination :46000

*raw
-A PREROUTING -p udp --dport 36000 -j CT --notrack
-A PREROUTING -p udp -j ACCEPT
-A OUTPUT -p udp --dport 36000 -j CT --notrack
-A OUTPUT -p udp -j ACCEPT

*filter

-A INPUT -p udp -m udp --dport 36000 -j ACCEPT --> rule 1
-A INPUT -p udp -m udp --dport 46000 -j ACCEPT --> rule 2
-A OUTPUT -p udp -m udp --dport 36000 -j ACCEPT -> rule 3

When i send a packet out from App A to Srv X it goes fine. There is no conntrack entry in /proc/net/ip_conntrack and OUT packet matches rule 3. When the response comes from Srv X to App A, the packet traverses raw table but it DOES NOT undergo DNAT and directly jumps to filter table rule 1. This means Srv X response comes to my box but it goes to App B instead of App A.

Questions:

  1. RAW table indicates there is no CONNTRACK. However, the above behaviour indicates the first packet App A -> Srv X with src and dst port as 36000 - 36000 is being tracked by some module somewhere. Hence the response from Srv X -> App A does not seem to undergo DNAT. How do i avoid this CONNTRACK?

  2. How to ensure every incoming packet from Srv X with dst port 36000 always undergoes DNAT?

Thanks in advance, Telex

migrated from security.stackexchange.com May 18 '15 at 7:19

This question came from our site for information security professionals.

  • There used to be a RAWDNAT and RAWSNAT target in xtables-addons. Now I believe their functionality has been absorbed by DNETMAP. – Lorenzo Pistone Jul 29 '15 at 13:10
  • No, sorry, DNETMAP still uses conntrack. – Lorenzo Pistone Jul 29 '15 at 13:25
2

By looking at the Netfilter documentation, it is said that "Connection tracking is fundamental to NAT", hence you cannot have DNAT without enabling conntrack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.