Home / ubuntu / Questions / 8250
In Process
skypemesm
Asked: 2010-10-20 02:36:06 +0800 CST

Weird issue with iptables redirection

  • 772

I am trying to redirect all incoming traffic on UDP port 5060 to port 56790, and all outgoing traffic from 5060 to the port 56789. I used these iptables rules:

iptables -t nat -I PREROUTING -p udp ! -s localhost --dport 5060 -j REDIRECT --to-port 56790
iptables -t nat -I OUTPUT -p udp ! -s localhost --sport 5060 -j REDIRECT --to-port 56789

I listen on both ports using RAW SOCKETS after setting the interface to PROMISCUOUS mode using ioctl.

I see packets ONLY on 56789 i.e.SENDING side, and I do not see any packets on 56790, while wireshark shows that many packets are delivered to port 5060.

Why would this happen? Any ideas? Do you think it's a problem with iptables rules or something to do with raw sockets?

[This is ubuntu 10.04 and iptables v1.4.4]

iptables routing

1 Answers

  1. If you want to transparently redirect packets arriving to port 5060/udp to port 56790/udp, then you need two iptables rules for that: one for incoming packets, and one to map reply packets (which have source port 56790) back to remote destination port 5060:

    sudo iptables -A PREROUTING -p udp -m udp --dport 5060 -j DNAT --to-destination :56790
sudo iptables -A POSTROUTING -p udp -m udp --sport 56790 -j SNAT --to-source :5060

    Conversely, to redirect outgoing packets (originating from port 5060 and intended for port 5060) to port 56789, you swap the port numbers:

    sudo iptables -A PREROUTING -p udp -m udp --dport 57689 -j DNAT --to-destination :5060
sudo iptables -A POSTROUTING -p udp -m udp --sport 5060 -j SNAT --to-source :56789
    • 3