1

I am trying to follow some guidelines to forward UDP traffic, but it seems that nothing works.

I am having a Syslog server pushing logs to my Logstash instance (yes, EC2) on port 514.

As this is a privileged port and I don't want to give JAVA privileges to run on non-privileged ports due to security restrictions, I need to forward the UDP traffic from one port to another port on the same interface.

I am not using loopback interface.

For testing purposes, I am using port 1025 as a DST port.

First, I am generating UDP traffic inside my VPN network using nc, like this:

nc -u xx.xx.xx.xx 1025

Where xx.xx.xx.xx is internal IP address. This machine is not reachable from the internet.

I can see traffic incoming on port 1025 using tcpdump, like this:

tcpdump -i eth0 UDP port 1025 -vv -X

I want this traffic being forwarded to port, let us say, 55514.

My NAT table looks like this:

[email protected]:/home/ubuntu# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
REDIRECT   udp  --  anywhere             anywhere             udp dpt:1025 redir ports 55514

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

However, I do not see any traffic on the same interface when using tcpdump:

[email protected]:/home/ubuntu# tcpdump -i eth0 UDP port 55514 -vv -X
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

I have read dozens of articles, tried various rules, but I can't just put it to work.

As far as I read, the PREROUTING doesn't make sense when using the same interface.

Port forwarding is enabled:

[email protected]:/home/ubuntu# cat /proc/sys/net/ipv4/conf/eth0/forwarding
1

As it is EC2 instance, I have disabled src/dest check, but again, the traffic is not leaving this machine, so it shouldn't be relevant.

EDIT:

Machine is Ubuntu 16.04.6 LTS.

EDIT:

[email protected]:/home/ubuntu# iptables -L -t nat -v -n
Chain PREROUTING (policy ACCEPT 156 packets, 34827 bytes)
 pkts bytes target     prot opt in     out     source               destination
    5   163 REDIRECT   udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:1025 redir ports 55514
    0     0 REDIRECT   udp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:1025 redir ports 6363

Chain INPUT (policy ACCEPT 157 packets, 34861 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 13 packets, 1201 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 13 packets, 1201 bytes)
 pkts bytes target     prot opt in     out     source               destination
3
  • Could you please paste the output of iptables-save? Nov 11, 2019 at 16:57
  • @MirceaVutcovici Actually I don't have output. But I haven't restarted the machine. P.S. Ubuntu, but it shouldn't differ.
    – Alan Kis
    Nov 11, 2019 at 17:01
  • 1
    Or the output of iptables -L -t nat -v -n Nov 11, 2019 at 17:02

0

You must log in to answer this question.

Browse other questions tagged .