Linux iptables DNAT on incoming packet without conntrack (stateless)

Question

In my linux box 10.20.1.1, i got two UDP apps binded on port 46000 (App A) and 36000(App B) respectively. The apps communicate with two UDP servers bindeded as 10.10.1.1:36000 (Srv X) and 10.10.1.2:36000 (Srv Y) respectively.

When i send the packet out i have a requirement to always use UDP src port as 36000. The packet on wire will be always 36000 - 36000 src and dst ports.

My iptables rules are like below. My intention is to DNAT the incoming packet from Srv X from port 36000 to 46000 so that App A receives it.

*nat
-A PREROUTING -s 10.10.1.1/32 -p udp --dport 36000 -j DNAT --to-destination :46000

*raw
-A PREROUTING -p udp --dport 36000 -j CT --notrack
-A PREROUTING -p udp -j ACCEPT
-A OUTPUT -p udp --dport 36000 -j CT --notrack
-A OUTPUT -p udp -j ACCEPT

*filter

-A INPUT -p udp -m udp --dport 36000 -j ACCEPT --> rule 1
-A INPUT -p udp -m udp --dport 46000 -j ACCEPT --> rule 2
-A OUTPUT -p udp -m udp --dport 36000 -j ACCEPT -> rule 3

When i send a packet out from App A to Srv X it goes fine. There is no conntrack entry in /proc/net/ip_conntrack and OUT packet matches rule 3. When the response comes from Srv X to App A, the packet traverses raw table but it DOES NOT undergo DNAT and directly jumps to filter table rule 1. This means Srv X response comes to my box but it goes to App B instead of App A.

Questions:

1. RAW table indicates there is no CONNTRACK. However, the above behaviour indicates the first packet App A -> Srv X with src and dst port as 36000 - 36000 is being tracked by some module somewhere. Hence the response from Srv X -> App A does not seem to undergo DNAT. How do i avoid this CONNTRACK?

2. How to ensure every incoming packet from Srv X with dst port 36000 always undergoes DNAT?

Thanks in advance, Telex

Answer 1

By looking at the Netfilter documentation, it is said that "Connection tracking is fundamental to NAT", hence you cannot have DNAT without enabling conntrack.