There are 4 servers:
- A - partner server with public IP
- B - our server with public IP
- C - our another server, but in LAN
- D - external third party server for testing
I control B, C and D. There is GRE over IPSec tunnel between A and B. I wanted to switch tunneling between A and C (so that B only forwards packets). First step I did on B was:
iptables -t nat -I PREROUTING -s A-IP -p udp --dport 500 -j DNAT --to-destination C-IP
I observed before that A is sending packets from A-IP:500 to B-IP:500. So above rule should replace B-IP with C-IP. B can communicate with C without problems through separate LAN interface. Proper routing entries are in place.
But it didn't work. When I entered the rule tcpdump showed abosuletely no change. I observed no packets on LAN interface directed to C-IP. And yes,
So I did another test. In this rule I replaced A-IP with D-IP (which is my home computer). Then I did:
echo test > /dev/udp/B-IP/500
and it worked. tcpdump showed that packet was properly forwarded to B's LAN interface and reached C.
Is there something specific with this protocol? What am I missing?