I have several dedicated servers hosted in several datacenters, and I want to migrate mail (pop3, imap, smtp and their TLS/SSL variants) services from one server to another.
For that purpose, I intend to temporarily install a NAT routing on the new server to the old one for handling the time of DNS propagation.
So I defined the following IPTABLES rules :
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 25 -j DNAT --to-destination <my_remote_ip>:8025
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 110 -j DNAT --to-destination <my_remote_ip>
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 143 -j DNAT --to-destination <my_remote_ip>
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 465 -j DNAT --to-destination <my_remote_ip>:8465
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 587 -j DNAT --to-destination <my_remote_ip>:8587
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 993 -j DNAT --to-destination <my_remote_ip>
iptables -t nat -A PREROUTING -p tcp -m tcp --dport 995 -j DNAT --to-destination <my_remote_ip>
iptables -t nat -A POSTROUTING -d <my_remote_ip> -p tcp -m tcp --dport 110 -j SNAT --to-source <my_local_ip>
iptables -t nat -A POSTROUTING -d <my_remote_ip> -p tcp -m tcp --dport 143 -j SNAT --to-source <my_local_ip>
iptables -t nat -A POSTROUTING -d <my_remote_ip> -p tcp -m tcp --dport 993 -j SNAT --to-source <my_local_ip>
iptables -t nat -A POSTROUTING -d <my_remote_ip> -p tcp -m tcp --dport 995 -j SNAT --to-source <my_local_ip>
iptables -t nat -A POSTROUTING -d <my_remote_ip> -p tcp -m tcp --dport 8025 -j SNAT --to-source <my_local_ip>:25
iptables -t nat -A POSTROUTING -d <my_remote_ip> -p tcp -m tcp --dport 8465 -j SNAT --to-source <my_local_ip>:465
iptables -t nat -A POSTROUTING -d <my_remote_ip> -p tcp -m tcp --dport 8587 -j SNAT --to-source <my_local_ip>:587
iptables -A FORWARD -d <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --dport 110 -j ACCEPT
iptables -A FORWARD -d <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --dport 143 -j ACCEPT
iptables -A FORWARD -d <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --dport 993 -j ACCEPT
iptables -A FORWARD -d <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --dport 995 -j ACCEPT
iptables -A FORWARD -d <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --dport 8025 -j ACCEPT
iptables -A FORWARD -d <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --dport 8465 -j ACCEPT
iptables -A FORWARD -d <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --dport 8587 -j ACCEPT
iptables -A FORWARD -s <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --sport 110 -j ACCEPT
iptables -A FORWARD -s <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --sport 143 -j ACCEPT
iptables -A FORWARD -s <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --sport 993 -j ACCEPT
iptables -A FORWARD -s <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --sport 995 -j ACCEPT
iptables -A FORWARD -s <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --sport 8025 -j ACCEPT
iptables -A FORWARD -s <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --sport 8465 -j ACCEPT
iptables -A FORWARD -s <my_remote_ip> -i eth0 -o eth0 -p tcp -m tcp --sport 8587 -j ACCEPT
(actually simplified, in fact this is duplicated for IPv4 and IPV6, and on some servers the interface may be different than eth0 … and of course I mangled the actual IP addresses)
You may note that mail services are only NAT'ed, but that SMTP related services have also a port translation, associated with either the reverse translation or the specific listening of these ports on the destination server.
There is a compelling reason for that: my hosting provider uses to monitor outgoing SMTP connections in order to detect and block spam hosted on all servers hosted by them. But if I forward incoming connections to SMTP port to another of my servers, incoming spam becomes outgoing spam (from the point of view of the datacenter) before it has any chances to be filtered (on the destination server), and the result is that my hosting provider immediately blocks the NAT'ting server.
So I have to translate also the port number in order to forward these connections.
Incoming packets and outgoing (NAT'ed) packets use the same interface (because these servers have only one network interface).
Actually this works more or less, except that the port forwarded connections (and only these ones, no problem on ports 110, 143, etc) have a strange behaviour: they work the first time I use them, but if I disconnect and reconnect immediately, the forwarding no longer works and I have to wait about 1 to 3 minutes before being able to connect again.
This seems to be related to the IP address, not to the port number: Even if the previous connection was on port 110 (pop3, not port forwarded), I have to wait the same delay before being able to connect to port 25.
I have verified that on several servers, all of them being Linux Debian Wheezy, Jessie or Stretch, and on both IPv4 and IPv6 (except on Wheezy which cannot NAT IPv6). ……… Yes, I know that Wheezy is now old, this is why I am migrating.
All IP addresses are fully static.
And yes, I have set /proc/sys/net/ipv4/ip_forward (and it's IPv6 equivalent) to 1.
I use telnet for testing the connections, and I check the forwarding with tcpdump. With the latter I can check that the forwarding is really not done, and that it is not the destination server which blocks the incoming connections.
Please could someone help me to find the reason of this 1-3 minutes blocking delay and how I could fix it?
Gingko
