I have a weird situation on one of my setups. I have described the setup below, but I have multiple of these setups, all with the same rules, but the problem happens on only one.
I am doing this on Centos 6.5, kernel version 3.10.14. I am trying to SNAT traffic coming in from eth0 and being forwarded on eth1. I have an iptable rule that says (in the nat table)
-A POSTROUTING -s 10.92.0.0/14 -o eth1 -j SNAT --to-source 126.96.36.199 --random --persistent
188.8.131.52 is the IP address on eth1.
I see an UDP packet come in on
eth0, has an IP
10.92.0.1 and is routed out of
eth1, but never gets natted. I have added iptables logs+trace and I see the packet hitting mangle POSTROUTING, but not NAT POSTROUTING. TCP and ICMP from the same IP works fine. And this happens on only one setup among many.
I have checked the iptables counters and I do not see the NAT POSTROUTING rule being hit for this packet.
I have connection tracking enabled, I see the connections for TCP and ICMP being tracked. I also see UDP packets originated by the box being tracked (and natted), only the ones being forwarded are not.
iptables logs show that the packet was routed out of eth1 correctly.
I tried to enable conntrack logging to by writing 17 (for UDP) to /proc/sys/net/netfilter/nf_conntrack_log_invalid . But I do not see any logs.
I have tried with different destination address and ports, but no go. I do not have udp specific rules anywhere.
I have may be 15 connections in the conntrack table. The max is 65K.
Is there any way to check why the UDP connection is not being tracked? Any logs that can help?
Are there issues with UDP and NAT?
Is there any other way to debug the NF module?
Thanx in advance for any help/pointers.