2

I have a device sending UDP syslog messages to my server on port 514. I have confirmed this traffic is reaching my server by checking with ifconfig as well as running my collector software under root for testing.

To avoid having to run my collector as root I want to forward incoming traffic on port 514 to something else. However for some reason I can't get IPtables to do this despite having used the same commands before with success.

Rules I created:

iptables -t nat -I PREROUTING --src 0/0 --dst 127.0.0.1 -p udp --dport 514 -j REDIRECT --to-ports 9901

and 

iptables -I INPUT 1 -p udp -m udp --dport 9901 -j ACCEPT

What am I missing? As the collector is picking up the data when checking on port 514 (even with the above rules in place) I figure somehow IPtables if failing to forward the traffic.

Improve this question

2 Answers 2

Reset to default
3

If your packets are generated locally, they enter the OUTPUT chain. In that case, you could add a -j REDIRECT in the OUTPUT chain, in the nat table.

If the inbound packets are non-local, then enabling the route_localnet option for the relevant interface might do the trick.

# sysctl -w net.ipv4.conf.<IFNAME>.route_localnet=1

or

# echo 1 > /proc/sys/net/ipv4/conf/<IFNAME>/route_localnet

route_localnet - BOOLEAN Do not consider loopback addresses as martian source or destination while routing. This enables the use of 127/8 for local routing purposes. default FALSE

Ref: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

Improve this answer
2
  • 1
    The original packet is coming from an external source, but I want to redirect it from port 514 to 9901 on the localhost. I tried playing with the REDIRECT and OUTPUT rules but nothing works. Also confirmed route_localnet is set to 1.
    – sjaak
    Feb 27, 2020 at 1:00
  • @sjaak if the packet is coming from an external source, then the destination ip in your PREROUTING rule needs to reflect the ip address of the inbound interface, instead of 127.0.0.1 (or just use the interface name instead)
    – user234931
    Feb 27, 2020 at 9:04
2

Try this:

iptables -t nat -I PREROUTING --src 0/0 --dst {server-ip-address} -p udp --dport 514 -j REDIRECT --to-ports 9901

Replace {server-ip-address} with your servers ip-address (in most cases it's your LAN address of the machine).

The problem is that your inbound packets have a destination ip-address of the server machine and not 127.0.0.1.

I believe the rule you have created only matches packets sent from your server back to your server (as suggested with the rule containing the loopback address of 127.0.0.1). Therefore your PREROUTING rule cannot recognize a match with packets from external machines. This is fixed by replacing the loopback address with your server's ip-address.

If iptables on Linux is confusing, I suggest looking at the man-pages for iptables or this resource that helped me: https://www.karlrupp.net/en/computer/nat_tutorial

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .