How to translate UDP unicast packet to a broadcast address via DNAT with iptables
or something else?
2 Answers
With iptables is not possible (AFAIK) unless you allow the broadcass traffic to pass to the router (IMHO a bad idea).
DNAT is performed in PREROUTING, the packets are DNAT'ed to broadcast in this chain, and when these packets arrive to routing decision it's broadcast traffic wich is usually blocked and doesn't go to FORWARD.
Other option is to set an static ARP entry wich translates the target unicast IP to broadcast ethernet address.
Actually iptables doesn't do any broadcast. The routing mechanism may do this when it sees packet has broadcast destination address
As said earlier it drops any forwarded broadcast by default
It's became possible to forward directed UDP broadcast in recent Linux kernel (circa version 5.0)
You need to modify bc_forwarding parameter for broadcasting network interface:
sudo sysctl -w net.ipv4.conf.eth1.bc_forwarding=1
(Note: it seems the option net.ipv4.conf.all.bc_forwarding doesn't work)
-
From trial and error, It appears that the incoming interface and the all interface must be both enabled for the feature to work (the interface where the broadcast will actually happen doesn't require it). Also note that while Netfilter can perform successfully a DNAT, it will set a never matching conntrack entry expecting the broadcast address as source, so replies won't work properly. Still good enough for example for WOL.– A.BMay 15, 2021 at 14:24
-
The reason for both is that they map to the two conditions in rfc1812+rfc2644: "A router MAY have an option to enable receiving network-prefix-directed broadcasts on an interface" (the interface flag) "and MAY have an option to enable forwarding network-prefix-directed broadcasts." (the all flag). Be careful rfc1812 is old and was (re)written at a time when classful (class A, B, C ...) networking was still lingering in minds.– A.BMay 15, 2021 at 16:59