6

The same effect on many servers with various kernel versions.

There are multiple Iptables DNAT rules:

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 12345 -j DNAT --to-destination 10.20.30.40:5678
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 23456 -j DNAT --to-destination 10.11.12.13:5789
....
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 34567 -j LOG --log-prefix 'natudp: '
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 34567 -j DNAT --to-destination 10.55.66.77:34567

Problem: UDP rules are not working for incoming requests from eth0.
Packet and bytes counters for them have zero values.
Simplification (removing dport) has no effect.
As result, requests are passed to filter/INPUT chain instead of FORWARD.

No such problem for packets from virtual interfaces (tap, veth) - they are trapped by prerouting rules.
No such problem for TCP.
No such problem for UDP answers.
But incoming UDP requests from eth0 are ignored by prerouting rules at all:

# iptables -t nat -nvL PREROUTING
Chain PREROUTING (policy ACCEPT 3 packets, 174 bytes)
 pkts bytes target   prot opt in     out   source        destination         

(testing rules)
    2   126 LOG      udp  --  *      *     0.0.0.0/0     0.0.0.0/0      LOG flags 0 level 4 prefix "prerouting-udp: "
    0     0          udp  --  *      *     1.2.3.4       0.0.0.0/0               
    0     0          udp  --  *      *     1.2.3.4       0.0.0.0/0      udp dpt:25826
    0     0          udp  --  eth0   *     0.0.0.0/0     0.0.0.0/0      udp dpt:25826
    0     0          udp  --  eth0   *     1.2.3.4       0.0.0.0/0           
    0     0          udp  --  eth0   *     1.2.3.4       0.0.0.0/0      udp dpt:25826

(production rules)
    7   412 DNAT     tcp  --  eth0   *     0.0.0.0/0     0.0.0.0/0      tcp dpt:12345 to:10.20.30.40:8080
   63  3804 DNAT     tcp  --  eth0   *     0.0.0.0/0     0.0.0.0/0      tcp dpt:56789 to:10.30.40.50:8000
    0     0 DNAT     udp  --  eth0   *     1.2.3.4       0.0.0.0/0      udp dpt:25826 to:10.40.50.60:25826

Any ideas?

3
  • Could you give us the result of iptables -t nat -L PREROUTING -n ?
    – Dom
    Feb 4, 2016 at 19:16
  • Could you add the 2 lines of LOG in UDP ?
    – Dom
    Feb 5, 2016 at 17:47
  • Why the packets should come FROM 1.2.3.4. They should be on the destination, if 1.2.3.4 is your IP.
    – Dom
    Feb 5, 2016 at 17:49

1 Answer 1

1

Same thing here. As the last thing to check, check the conntrack table. In my case, resetting the tracked connections make the rules work instantly.

apt install conntrack -y
# see current UDP connection
conntrack -L -p udp --dport 34567
# in OP's case purge tracking entries per rule U:dport=34567
conntrack -D -p udp --dport 34567
# if not care
# conntrack -D -p udp

Or if uptime is not vital for the device, simply reboot which is another way of conntrack -D.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .