IN SHORT: I need a port redirection on a connection-oriented protocol, just like it would be for TCP - but I need that it work for UDP. I have a custom connection-oriented protocol using UDP for transport.

In particular:

  1. The machine to be configured is listening on port 5005 UDP.
  2. UDP packets are expected to come from, say,
  3. This machine should forward this packet to, say, port 5010.
  4. ... and the other way around!

For 4, more precisely: when a packet comes from, it is assigned a random port, say, 52000. Then, THIS machine receives packet on UDP port 5005 and forwards it to having also some randomly-selected source port, say, 52001. Now, when there's coming a packet from port 5010 to THIS machine port 52001, it should redirect it also to port 52000.

Moreover, if there's coming a packet from another port on, the port assignment and according rule for reverse-direction packet redirection should apply as well. It may be set 10s timeout for any traffic, after which the backward track rule is removed.

If this cannot be done using iptables, I'm fine with it - I'll fall back to a userspace solution. But with iptables it will simplify the deployment.

  • Is your application using multiple sockets? Normally, the port numbers should not be changing this way! – Khaled Jan 26 '17 at 14:30
  • In short, this protocol behaves logically as TCP - it uses connections, handshakes, keepalives, all that stuff. At the same time there can run multiple applications on given machine, each one connecting to the destination address independently - just like TCP. – Ethouris Jan 26 '17 at 14:54

Your proxy server is thus doing a double NAT, masquerading (by hiding the other real peer) both ways.

  • It has to be configured as a router on its (single) interface or nothing will be forwarded. Let's say the interface name is eth0, and its IP is

    echo 1 > /proc/sys/net/ipv4/conf/eth0/forwarding
  • Now because of the double NAT, the transformations in PREROUTING and/or POSTROUTING prevent matching the flow just using again the same filter. So in PREROUTING a CONNMARK is used to mark the flow which can then be reused immediately in PREROUTING (and avoiding duplicating the specific test for easier management) and later in POSTROUTING. Note -p udp is still needed because we ask SNAT and/or DNAT to alter UDP ports. After that conntrack will handle all future exchange, as long as it doesn't time out (usually 30s for first reply, then 3mn)

    iptables -t nat -A PREROUTING -s -p udp --dport 5005 -j CONNMARK --set-mark 0x1
    iptables -t nat -A PREROUTING -p udp -m connmark --mark 0x1 -j DNAT --to-destination
    iptables -t nat -A POSTROUTING -m connmark --mark 0x1 -j SNAT --to-source

    If it's really a requirement that you also alter the source port, instead of having conntrack do it only when needed, change the 3rd rule into:

    iptables -t nat -A POSTROUTING -p udp -m connmark --mark 0x1 -j SNAT --random-fully --to-source

    (usual range taken from /proc/sys/net/ipv4/ip_local_port_range, and --random-fully is needed else nothing is done because the original port is already in range).
    You could also change SNAT to MASQUERADE (and not have to state server IP) but only --random is available.

UPDATE: while the above rules work as intended, usually the connmark match and the CONNMARK target are intended for interaction with mark and MARK for a more complex usage as described in this blog. They are not needed for the simple usage here. Simply replace them all with resp. mark and MARK. Here netfilter's connection tracking already takes care of the flow once the first packet is handled (creating a conntrack entry in NEW state) without having to ask it to mark it in the conntrack entry. A mark is just put in the (first) packet (the nat table sees only packets in NEW state):

iptables -t nat -A PREROUTING -s -p udp --dport 5005 -j MARK --set-mark 0x1
iptables -t nat -A PREROUTING -p udp -m mark --mark 0x1 -j DNAT --to-destination
iptables -t nat -A POSTROUTING -m mark --mark 0x1 -j SNAT --to-source

Example captures, including errors (service not running etc.):

00:28:36.476453 IP > UDP, length 5
00:28:36.476487 IP > UDP, length 5
00:28:36.476516 IP > ICMP udp port 5010 unreachable, length 41
00:28:36.476522 IP > ICMP udp port 5005 unreachable, length 41

00:32:28.597050 IP > UDP, length 5
00:32:28.597084 IP > UDP, length 5
00:32:32.503709 IP > UDP, length 7
00:32:32.503745 IP > UDP, length 7
00:32:41.704371 IP > UDP, length 4
00:32:41.704404 IP > UDP, length 4
00:32:41.704427 IP > ICMP udp port 35443 unreachable, length 40
00:32:41.704433 IP > ICMP udp port 36842 unreachable, length 40

Please note that, you can replace all of this with this simple socat line (and you don't get any 30s/3mn timeout but you lose ICMP handling):

socat UDP4-LISTEN:5005,range=,fork UDP4:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.