Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to redirect UDP incoming packets to port 4000 to another IP with iptables:

iptables -t nat -A PREROUTING -p udp --dport 4000 -j DNAT --to-destination 192.168.100.20

Unfortunately they ate not coming to the second machine.

There are 2 IP on same interface on redirecting machine have :

eth0      Link encap:Ethernet  HWaddr 40:61:86:59:dc:51  
          inet addr:192.168.100.10  Bcast:192.168.100.255  Mask:255.255.255.0
          inet6 addr: fe80::4261:86ff:fe59:dc51/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:132063085 errors:0 dropped:906 overruns:0 frame:0
          TX packets:72290128 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:144144488311 (144.1 GB)  TX bytes:41926073103 (41.9 GB)

eth0:1    Link encap:Ethernet  HWaddr 40:61:86:59:dc:51  
          inet addr:192.168.100.121  Bcast:192.168.100.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

Pakets are addressed to second IP 192.168.100.121. and I can see they are coming:

tcpdump -i any -n udp port 4000
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked), capture size 65535 bytes
13:24:05.201938 IP 192.168.100.144.4000 > 192.168.100.121.4000: UDP, length 24
13:24:09.980703 IP 192.168.100.141.4000 > 192.168.100.121.4000: UDP, length 24

So I try to "debug" it

Here is my iptables script:

iptables -F
iptables -F -t mangle
iptables -F -t nat
iptables -F -t raw
iptables -F -t filter
iptables -X
iptables -X -t mangle
iptables -X -t nat
iptables -X -t raw
iptables -X -t filter

iptables -P FORWARD ACCEPT
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT

iptables -t raw -A PREROUTING -p udp --dport 4000 -j LOG --log-prefix "UDP raw PREROUTING: "
iptables -t raw -A OUTPUT -p udp --dport 4000 -j LOG --log-prefix "UDP raw OUTPUT: "    
iptables -t mangle -A PREROUTING -p udp --dport 4000 -j LOG --log-prefix "UDP mangle PREROUTING: "
iptables -t mangle -A INPUT -p udp --dport 4000 -j LOG --log-prefix "UDP mangle INPUT: "
iptables -t mangle -A FORWARD -p udp --dport 4000 -j LOG --log-prefix "UDP mangle FORWARD: "
iptables -t mangle -A OUTPUT -p udp --dport 4000 -j LOG --log-prefix "UDP mangle OUTPUT: "
iptables -t mangle -A POSTROUTING -p udp --dport 4000 -j LOG --log-prefix "UDP mangle POSTROUTING: "
iptables -t nat -A PREROUTING -p udp --dport 4000 -j LOG --log-prefix "UDP nat PREROUTING: "
iptables -t nat -A INPUT -p udp --dport 4000 -j LOG --log-prefix "UDP nat INPUT: "
iptables -t nat -A OUTPUT -p udp --dport 4000 -j LOG --log-prefix "UDP nat OUTPUT: "
iptables -t nat -A POSTROUTING -p udp --dport 4000 -j LOG --log-prefix "UDP nat POSTROUTING: "    
iptables -t filter -A INPUT -p udp --dport 4000 -j LOG --log-prefix "UDP filter INPUT: "
iptables -t filter -A FORWARD -p udp --dport 4000 -j LOG --log-prefix "UDP filter FORWARD: "
iptables -t filter -A OUTPUT -p udp --dport 4000 -j LOG --log-prefix "UDP filter OUTPUT: "
iptables -A INPUT -p udp --dport 4000 -j LOG --log-prefix "UDP INPUT: "
iptables -A FORWARD -p udp --dport 4000 -j LOG --log-prefix "UDP FORWARD: "
iptables -A OUTPUT -p udp --dport 4000 -j LOG --log-prefix "UDP OUTPUT: "

the result shows that packets are not reaching NAT table:

tail -f /var/log/syslog
Jun  2 13:40:05 xyz kernel: [1908838.254623] UDP raw PREROUTING: IN=eth0 OUT= MAC=40:61:86:59:dc:51:00:21:29:81:ed:48:08:00 SRC=192.168.100.144 DST=192.168.100.121 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=190 DF PROTO=UDP SPT=4000 DPT=4000 LEN=32 
Jun  2 13:40:05 xyz kernel: [1908838.254667] UDP mangle PREROUTING: IN=eth0 OUT= MAC=40:61:86:59:dc:51:00:21:29:81:ed:48:08:00 SRC=192.168.100.144 DST=192.168.100.121 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=190 DF PROTO=UDP SPT=4000 DPT=4000 LEN=32 
Jun  2 13:40:05 xyz kernel: [1908838.254693] UDP mangle INPUT: IN=eth0 OUT= MAC=40:61:86:59:dc:51:00:21:29:81:ed:48:08:00 SRC=192.168.100.144 DST=192.168.100.121 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=190 DF PROTO=UDP SPT=4000 DPT=4000 LEN=32 
Jun  2 13:40:05 xyz kernel: [1908838.254712] UDP filter INPUT: IN=eth0 OUT= MAC=40:61:86:59:dc:51:00:21:29:81:ed:48:08:00 SRC=192.168.100.144 DST=192.168.100.121 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=190 DF PROTO=UDP SPT=4000 DPT=4000 LEN=32 
Jun  2 13:40:05 xyz kernel: [1908838.254730] UDP INPUT: IN=eth0 OUT= MAC=40:61:86:59:dc:51:00:21:29:81:ed:48:08:00 SRC=192.168.100.144 DST=192.168.100.121 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=190 DF PROTO=UDP SPT=4000 DPT=4000 LEN=32

There are no other iptables rules.

Can someone advice me something?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.