My iptables DNAT rules don't work until reboot. If I reboot my server, all of the rules work.
Desciption of the architecture :
Tens of hosts (senders) send some UDP packets (one-way on a specific port 9999) to my Linux router. This Linux router use iptables to forward those packets to several hosts (receivers).
senderX 10.0.0.X ====> Linux router with iptables ====> receiverY 10.0.1.Y
The linux router have two network cards eth1 10.0.0.1/24 (senders side) and eth0 10.0.1.1/24 (receivers side).
Iptables setup :
- ip_forwarding is activated
- all of the default policies are set to ACCEPT
- one iptables rules exist per sender, here is an example :
iptables -t nat -A PREROUTING -s 10.0.0.2 -i eth1 -j DNAT --to-destination 10.0.1.123
Network setup :
ip addr show
:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 54:9f:35:0a:16:38 brd ff:ff:ff:ff:ff:ff
inet 10.0.1.1/24 brd 10.0.1.255 scope global eth0
inet6 fe80::569f:35ff:fe0a:1638/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
link/ether 54:9f:35:0a:16:3a brd ff:ff:ff:ff:ff:ff
inet 10.0.0.1/24 brd 10.0.0.255 scope global eth1
inet6 fe80::569f:35ff:fe0a:163a/64 scope link
valid_lft forever preferred_lft forever
Symptom :
After adding a set of rules, some of the rules doesn't work. And I can see with tcpdump that UDP packets are no more routed and packets are rejected.
tcpdump -n -i eth1 host 10.0.0.2
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
16:12:58.241225 IP 10.0.0.2.56859 > 10.0.0.1.9999: UDP, length 1464
16:12:58.241285 IP 10.0.0.1 > 10.0.0.2: ICMP 10.0.0.1 udp port 9999 unreachable, length 556
- If I flush all the rules and reinject them in iptables, rules that was not working still not work.
- If I reboot my server all the rules work fine.
Analysis done :
I have added a rule to log a specific sender which is not working :
iptables -t nat -A PREROUTING -s 10.0.0.2 -i eth1 -j LOG --log-prefix='PREROUTING LOG :'
But this rule doesn't log anything. Packets are coming because I see those in tcpdump but they are not logged. Also with the -v
option in iptables, I don't see counters increasing for this rule.
If I apply the same rule before it stop working, I have some logs.
Question :
- Is there any limits on UDP forwarding in iptables ?
- How I can troubleshoot this issue ?
tcpdump
on both interfaces, that those packets really aren't making it through the router?iptables -L -t nat
-> but the redirection is still working (confirmed by tcpdump). I can still see the entry in conntrack :cat /proc/net/nf_conntrack | grep 10.0.0.2
.ipv4 2 udp 17 28 src=10.0.0.2 dst=10.0.0.1 sport=64149 dport=9999 [UNREPLIED] src=10.0.1.123 dst=10.0.0.2 sport=9999 dport=64149 mark=0 zone=0 use=2
iptables -L -n -v; iptables -t nat -L -n -v; ip addr show
in your question?iptables
firewalls for big companies with complex network setups, and never needed more than a couple of hundred.