Linux kernel is 4.9.17-8.31
I am opening up many external ports that map onto a single internal port. The reason is that each customer group gets there own port, this allows upstream accounting with tc.
Rules look something like this:
iptables -t nat -A PREROUTING -i eth0 -p tcp --match multiport --dports 3000,3032,3064,3096,3128,3160,3192,3224,3256,3288 -j REDIRECT --to-port 54321
iptables -t nat -A PREROUTING -i eth0 -p tcp --match multiport --dports 3330,3352,3384,3416,3448,3480,3512,3544,3576,3608 -j REDIRECT --to-port 54321
iptables -t nat -A PREROUTING -i eth0 -p tcp --match multiport --dports 3640,3672,3704,3736,3768,3800,3832,3864,3896,3928 -j REDIRECT --to-port 54321
iptables -t nat -A PREROUTING -i eth0 -p tcp --match multiport --dports 3960,3992,3024,3056,3088,3113,3152,3184,3216,3248 -j REDIRECT --to-port 54321
If I test 400 connections hitting one of these rules all the connections happen cleanly.
If I test 100 connections hitting each of the 4 rule lines I see timeouts and re-transmissions of the TCP SYN packets, I can tcpdump capture the TCP SYN is arriving, but not responded to, no TCP SYN ACK response.
I cannot find a drop or error point and all connections hitting one rule is very solid. In my test scenarios all 400 connections are from a single host, unsure if problem exists in a more real world scenario where connections will be coming from multiple hosts.
For testing purposes I have de-configured tc and can reproduce errors with iptables alone.
Interested to see if this behavior has been observed in the past.
