In my linux box
10.20.1.1, i got two UDP apps binded on port
46000 (App A) and
36000(App B) respectively. The apps communicate with two UDP servers bindeded as
10.10.1.1:36000 (Srv X) and
10.10.1.2:36000 (Srv Y) respectively.
When i send the packet out i have a requirement to always use UDP src port as 36000. The packet on wire will be always
36000 - 36000 src and dst ports.
My iptables rules are like below. My intention is to
DNAT the incoming packet from Srv X from port
36000 to 46000 so that App A receives it.
*nat -A PREROUTING -s 10.10.1.1/32 -p udp --dport 36000 -j DNAT --to-destination :46000 *raw -A PREROUTING -p udp --dport 36000 -j CT --notrack -A PREROUTING -p udp -j ACCEPT -A OUTPUT -p udp --dport 36000 -j CT --notrack -A OUTPUT -p udp -j ACCEPT *filter -A INPUT -p udp -m udp --dport 36000 -j ACCEPT --> rule 1 -A INPUT -p udp -m udp --dport 46000 -j ACCEPT --> rule 2 -A OUTPUT -p udp -m udp --dport 36000 -j ACCEPT -> rule 3
When i send a packet out from
App A to Srv X it goes fine. There is no conntrack entry in
/proc/net/ip_conntrack and OUT packet matches
rule 3. When the response comes from
Srv X to App A, the packet traverses raw table but it
DOES NOT undergo
DNAT and directly jumps to filter table rule 1. This means Srv X response comes to my box but it goes to App B instead of App A.
RAW table indicates there is no
CONNTRACK. However, the above behaviour indicates the first packet
App A -> Srv Xwith src and dst port as
36000 - 36000is being tracked by some module somewhere. Hence the response from
Srv X -> App Adoes not seem to undergo DNAT. How do i avoid this
How to ensure every incoming packet from Srv X with dst port 36000 always undergoes DNAT?
Thanks in advance, Telex