There are 4 servers:

  • A - partner server with public IP
  • B - our server with public IP
  • C - our another server, but in LAN
  • D - external third party server for testing

I control B, C and D. There is GRE over IPSec tunnel between A and B. I wanted to switch tunneling between A and C (so that B only forwards packets). First step I did on B was:

iptables -t nat -I PREROUTING -s A-IP -p udp --dport 500 -j DNAT --to-destination C-IP

I observed before that A is sending packets from A-IP:500 to B-IP:500. So above rule should replace B-IP with C-IP. B can communicate with C without problems through separate LAN interface. Proper routing entries are in place.

But it didn't work. When I entered the rule tcpdump showed abosuletely no change. I observed no packets on LAN interface directed to C-IP. And yes, /proc/sys/net/ipv4/ip_forward is 1.

So I did another test. In this rule I replaced A-IP with D-IP (which is my home computer). Then I did:

echo test > /dev/udp/B-IP/500

and it worked. tcpdump showed that packet was properly forwarded to B's LAN interface and reached C.

Is there something specific with this protocol? What am I missing?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.