Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to set up port forwarding on UDP from port 12345 to port 54321 using the following:

iptables -t nat -A PREROUTING -p udp -i eth0 -d 192.168.0.1  --dport 12345 -j DNAT --to 192.168.0.1:54321

iptables -A FORWARD -p udp -i eth0 -d 192.168.0.1 --dport 54321 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

This works fine for new connections, however, it wouldn't work for connections currently active.

To clarify what I mean, let's say that before adding the rules, there is an active connection from 192.168.0.2:55555 <---> 192.168.0.1:12345, and I am trying to redirect all incoming connections on 192.168.0.1:12345 to 192.168.0.1:54321.

After adding the above two rules, all other packets destined to 192.168.0.1:12345 are received at 192.168.0.1:54321 except the ones from 192.168.0.2:55555.

I guess the state of the connection plays a role in this. How can I solve this and get the packets from 192.168.0.1:55555 destined to port 12345 get delivered to port 54321?

share|improve this question

migrated from stackoverflow.com Aug 26 '12 at 8:46

This question came from our site for professional and enthusiast programmers.

1  
UDP are datagram packets, there's no sense of "active connection" like with TCP. Or are you talking about some higher layer protocol handshake? –  Jon Lin Aug 26 '12 at 3:40
    
I explained the case! I know UDP is connectionless, but after I add the port forwarding rules, packets from a previously seen remote IP and Port are not forwarded to the new port. –  Hooman Aug 26 '12 at 14:00
    
anyone has any suggestion? –  Hooman Sep 28 '12 at 23:59
add comment

1 Answer

up vote 1 down vote accepted

I figured out how to do it!

You need to use the REDIRECT on NAT! However before that you have to erase the entry corresponding to this connection from conntrack! Something like the following

conntrack -D -p udp -d  192.168.0.1 --dport=55555 
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.