0

I have the following problem:

Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1)
                                +VLAN200 ---> (PC2)

I am able to ping from PC1 to PC2 which are in different SUBNETS as above: Using NAT rules in iptables as below since they are in diferent SUBNETS

iptables -t nat -A POSTROUTING -o eth0.120 -j MASQUERADE
iptables -t nat -A POSTROUTING -o eth0.200 -j MASQUERADE

iptables -I FORWARD -i eth0.120 -o eth0.200 -p udp -m udp --dport 5060 -j ACCEPT
iptables -I FORWARD -i eth0.200 -o eth0.120 -p udp -m udp --dport 5060 -j ACCEPT
iptables -A FORWARD -j DROP  ---> This drops rest of the traffic.

WITHOUT the last DROP rule in FORWARD chain, I was able to establish a SIP connection.

However since I added the DROP rule to eliminate other traffic, I am not able to establish a SIP connection.

This means there are some other ports that the client and server are communicating through. In tcp dump it says 8000 sometimes 5435. This other port changes everytime.

So I read that Application level gateway can help in solving this problem.

How can I use ALG with iptables for allowing dynamic ports.

  • Why are you setting up NAT here? This is probably the problem. Don't NAT when you don't need to. – Michael Hampton Jul 20 '15 at 15:32
  • @MichaelHampton How am I suppose to forward the traffic from one subnet to another. eth0.120 and eth0.190 are in different subnets. Sorry this information is not mentioned above. – RootPhoenix Jul 21 '15 at 6:13
  • Just route it normally? – Michael Hampton Jul 21 '15 at 15:26
  • @MichaelHampton You mean just add the forwarding rules from eth0.120 to eth0.200 and vice versa.... remove the NAT rule ? – RootPhoenix Jul 22 '15 at 4:19
0

so i have managed to get this working:

First of all NAT is not required as suggested by Michael.

Now to allow SIP at port 5060 I used following rules:

iptables -D FORWARD -j delegate_forward;

iptables -D FORWARD -j DROP
iptables -I FORWARD -i eth0.120 -o eth0.200 -m state --state RELATED,ESTABLISHED -j ACCEPT;
iptables -I FORWARD -i eth0.200 -o eth0.120 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I FORWARD -i eth0.120 -o eth0.200 -p tcp --dport 5060 -m state --state NEW -j ACCEPT;
iptables -I FORWARD -i eth0.200 -o eth0.120 -p tcp --dport 5060 -m state --state NEW -j ACCEPT;

iptables -A FORWARD -i eth0.120 -o eth0.200 -p icmp -j ACCEPT;
iptables -A FORWARD -i eth0.200 -o eth0.120 -p icmp -j ACCEPT;

iptables -A FORWARD -j DROP;

And it works.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.