I have the following problem:
Device (eth0)----> SWITCH(trunk)+VLAN120 ---> (PC1) +VLAN200 ---> (PC2)
I am able to ping from PC1 to PC2 which are in different SUBNETS as above: Using NAT rules in iptables as below since they are in diferent SUBNETS
iptables -t nat -A POSTROUTING -o eth0.120 -j MASQUERADE iptables -t nat -A POSTROUTING -o eth0.200 -j MASQUERADE iptables -I FORWARD -i eth0.120 -o eth0.200 -p udp -m udp --dport 5060 -j ACCEPT iptables -I FORWARD -i eth0.200 -o eth0.120 -p udp -m udp --dport 5060 -j ACCEPT iptables -A FORWARD -j DROP ---> This drops rest of the traffic.
WITHOUT the last DROP rule in FORWARD chain, I was able to establish a SIP connection.
However since I added the DROP rule to eliminate other traffic, I am not able to establish a SIP connection.
This means there are some other ports that the client and server are communicating through. In tcp dump it says 8000 sometimes 5435. This other port changes everytime.
So I read that Application level gateway can help in solving this problem.
How can I use ALG with iptables for allowing dynamic ports.