0

Here is my /etc/sysconfig/iptables configuration:

*nat
:PREROUTING ACCEPT [106:8676]
:POSTROUTING ACCEPT [1885:116707]
:OUTPUT ACCEPT [1885:116707]
-A PREROUTING -p udp -m udp --dport 162 -j REDIRECT --to-ports 1162
-A PREROUTING -p udp -m udp --dport 514 -j REDIRECT --to-ports 1514
-A PREROUTING -p udp -m udp --dport 69 -j REDIRECT --to-ports 1069
-A PREROUTING -p udp -m udp --dport 161 -j REDIRECT --to-ports 1161
-A PREROUTING -p udp -m udp --dport 162 -j REDIRECT --to-ports 1162
-A PREROUTING -p udp -m udp --dport 514 -j REDIRECT --to-ports 1514
-A PREROUTING -p udp -m udp --dport 69 -j REDIRECT --to-ports 1069
-A PREROUTING -p udp -m udp --dport 161 -j REDIRECT --to-ports 1161
-A OUTPUT -d 127.0.0.1/32 -p udp -m udp --dport 162 -j REDIRECT --to-ports 1162
-A OUTPUT -d 127.0.0.1/32 -p udp -m udp --dport 162 -j REDIRECT --to-ports 1162
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [767:109441]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 162 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 514 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

The line

-A INPUT -p udp -m state --state NEW -m udp --dport 162 -j ACCEPT

doesn't work as expected. I mean UDP traffic to port 162 is not matched by the rule and still being dropped with icmp-host-prohibited sent back.

Could you please advise how I should modify the config to allow UDP traffic to port 162?

0

Your prerouting table is modifying the inbound port and that happens before INPUT. Update your INPUT rule to match the prerouting port, 1162.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.