Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a machine that has a DNAT rule that redirects data to neighbouring server:

iptables -t nat -A PREROUTING -p udp -d 10.99.193.116 --dport 54321 -j DNAT --to 10.99.193.115:54321

As can be seen, this rule is triggered quite frequently:

pkts bytes target     prot opt in     out     source               destination         
192K   19M DNAT       udp  --  *      *       0.0.0.0/0            10.99.193.116       udp dpt:54321 to:10.99.193.115:54321 

However, looking at the interface, the redirected packets are not sent out on the interface.

$ tcpdump -i eth0 -n port 54321
17:03:36.553363 IP 172.21.0.159.54321 > 10.99.193.116.54321: UDP, length 82
17:03:37.514257 IP 172.21.0.20.54321 > 10.99.193.116.54321: UDP, length 39
17:03:37.633556 IP 172.21.0.91.54321 > 10.99.193.116.54321: UDP, length 82
17:03:37.678211 IP 172.21.0.196.54321 > 10.99.193.116.54321: UDP, length 68
17:03:38.542620 IP 172.21.0.185.54321 > 10.99.193.116.54321: UDP, length 39

This problem occurred after the machine rebooted for the first time after adding these rules, so presumably there is some difference between then and now. But what? Or is there some kernel bug that means these packets are dropped even tho the counter is incremented?

The machine is a CentOS4 box, Linux 2.6.9-67.0.1.ELsmp.

share|improve this question

1 Answer 1

up vote 3 down vote accepted

You also need a FORWARD rule, for example:

iptables -t filter -I FORWARD -m udp -p udp --dst 10.99.193.115 --dport 54321 -j ACCEPT

and to enable forwarding, of course:

sysctl -w net.ipv4.ip_forward=1
share|improve this answer
    
Forwarding chain was default ACCEPT, but a echo 1 > /proc/sys/net/ipv4/conf/eth0/forwarding made a significant difference :). On behalf of a lot of customers: thank you! –  Bittrance Oct 10 '11 at 15:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.