2

I have a weird situation on one of my setups. I have described the setup below, but I have multiple of these setups, all with the same rules, but the problem happens on only one.

I am doing this on Centos 6.5, kernel version 3.10.14. I am trying to SNAT traffic coming in from eth0 and being forwarded on eth1. I have an iptable rule that says (in the nat table)

-A POSTROUTING -s 10.92.0.0/14 -o eth1 -j SNAT --to-source 70.70.70.5 --random --persistent

70.70.70.5 is the IP address on eth1.

I see an UDP packet come in on eth0, has an IP 10.92.0.1 and is routed out of eth1, but never gets natted. I have added iptables logs+trace and I see the packet hitting mangle POSTROUTING, but not NAT POSTROUTING. TCP and ICMP from the same IP works fine. And this happens on only one setup among many.

I have checked the iptables counters and I do not see the NAT POSTROUTING rule being hit for this packet.

I have connection tracking enabled, I see the connections for TCP and ICMP being tracked. I also see UDP packets originated by the box being tracked (and natted), only the ones being forwarded are not.

iptables logs show that the packet was routed out of eth1 correctly.

I tried to enable conntrack logging to by writing 17 (for UDP) to /proc/sys/net/netfilter/nf_conntrack_log_invalid . But I do not see any logs.

I have tried with different destination address and ports, but no go. I do not have udp specific rules anywhere.

I have may be 15 connections in the conntrack table. The max is 65K.

Is there any way to check why the UDP connection is not being tracked? Any logs that can help?

Are there issues with UDP and NAT?

Is there any other way to debug the NF module?

Thanx in advance for any help/pointers.

  • It is not usually possible to debug iptables issues with a single rule in isolation. It's almost always necessary to see the entire firewall. – Michael Hampton Dec 8 '17 at 3:21
  • What's different about the machine that isn't working? – womble Dec 8 '17 at 4:57
  • There is no difference between the working machine and non-working machine except for the NAT IP. – skp Dec 12 '17 at 1:36
  • 2
    Is there an earlier rule that it is hitting before it gets down to your SNAT rule? – user228546 Dec 20 '17 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.