Home / server / Questions / 1083952
In Process
Liam Kelly
Asked: 2021-11-19 09:05:20 +0800 CST

What is UDP Masquerading behavior when forwarding and listening on the same port to the same remote address?

  • 772

Assuming the following:

||netns2|<-kernel routing-> netnsRoot| <-network routing-> |remote server|

netns2

  • is a network namespace
  • has a client that connects to the UDP server on UDP/5060

netnsRoot

  • is the root network namespace (IE: typical linux routing)
  • has a client that connects to the UDP server on UDP/5060
  • Has ip_forward enabled and has a Masquerade rule for netns2

Server

  • Only sees traffic from the netnsRoot external interface

How does Masquerade behave in the netnsRoot? I would expect that it would forward packets from netns2 but the client in netnsRoot would receive all messages first. This is not what I think I am seeing, instead I am seeing netns2 NAT punch and take over the port for a period of time.

Is this behavior documented anywhere?

nat port-forwarding iptables nftables dnat

1 Answers

  1. Ok decided to quantify this myself

    ||netna|<-kernel routing-> |netnsr|<-kernel routing->|netnb||
    • netnsb has a route to netnsa
    • netnsr has ip forward enabled

    Masquerade and netnsb client

    enabling Masquerade in netnsr, and having a netnsb client connect to a netnsa server on 5060 from 5060 shows that 5060 is used exiting netnsr

    Masquerade and both client

    enabling Masquerade in netnsr, having a netnsb client connect to a netnsa server on 5060 from 5060 and having the same client run in netnsr shows:

    • netnsr client talking on 5060 externally
    • netnsb client talking on 29683 externally

    this is confirmed by the conntrack entries

    udp      17 119 src=10.216.210.2 dst=10.216.100.2 sport=5060 dport=5060 src=10.216.100.2 dst=10.216.100.1 sport=5060 dport=29683 [ASSURED] mark=0 use=1
udp      17 119 src=10.216.100.1 dst=10.216.100.2 sport=5060 dport=5060 src=10.216.100.2 dst=10.216.100.1 sport=5060 dport=5060 [ASSURED] mark=0 use=1
    • 0