iptables is re-writing the source port on my UDP packets that go out of a tun interface. I have NAT rules setup with port X forwarded (details below). When an application behind the NAT receives a forwarded UDP packet on port X, and then "replies" to it by sending another UDP packet, which should have source port X), that packet somehow gets source port 1024. The source port is already re-written before it even leaves the NATed box. Remote app rejects this packet because it is expecting source port X, not 1024.
I think the "implicit source port mapping" is taking place. I don't need that because port X is dedicated to one function and no clashing can occur: neither the NATing machine, nor any other machine will use that port. How do I force iptables to just keep the source port as it is?
On the host behind NAT where the packets with re-written source port originate, I tried the following (one a time), all with same results:
iptables -t nat -A POSTROUTING -o tun0 -p udp --sport X -j SNAT --to 10.7.0.5:X iptables -t nat -A POSTROUTING -o tun0 -p udp -j SNAT --to 10.7.0.5 iptables -t nat -A POSTROUTING -o tun0 -p udp -j MASQUERADE
On the remote externally-facing box that does the NAT:
iptables -t nat -A PREROUTING -i eth0 -p udp --dport X -j DNAT --to-destination 10.7.0.5:X iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE