1

How to translate UDP unicast packet to a broadcast address via DNAT with iptables or something else?

2 Answers 2

1

With iptables is not possible (AFAIK) unless you allow the broadcass traffic to pass to the router (IMHO a bad idea).

DNAT is performed in PREROUTING, the packets are DNAT'ed to broadcast in this chain, and when these packets arrive to routing decision it's broadcast traffic wich is usually blocked and doesn't go to FORWARD.

Other option is to set an static ARP entry wich translates the target unicast IP to broadcast ethernet address.

1

Actually iptables doesn't do any broadcast. The routing mechanism may do this when it sees packet has broadcast destination address

As said earlier it drops any forwarded broadcast by default

It's became possible to forward directed UDP broadcast in recent Linux kernel (circa version 5.0)

You need to modify bc_forwarding parameter for broadcasting network interface:

sudo sysctl -w net.ipv4.conf.eth1.bc_forwarding=1

(Note: it seems the option net.ipv4.conf.all.bc_forwarding doesn't work)

2
  • From trial and error, It appears that the incoming interface and the all interface must be both enabled for the feature to work (the interface where the broadcast will actually happen doesn't require it). Also note that while Netfilter can perform successfully a DNAT, it will set a never matching conntrack entry expecting the broadcast address as source, so replies won't work properly. Still good enough for example for WOL.
    – A.B
    May 15, 2021 at 14:24
  • The reason for both is that they map to the two conditions in rfc1812+rfc2644: "A router MAY have an option to enable receiving network-prefix-directed broadcasts on an interface" (the interface flag) "and MAY have an option to enable forwarding network-prefix-directed broadcasts." (the all flag). Be careful rfc1812 is old and was (re)written at a time when classful (class A, B, C ...) networking was still lingering in minds.
    – A.B
    May 15, 2021 at 16:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .