0

I am running alpine linux on a network gateway. I have configured port forwarding (iptables DNAT) but packets are not forwarded.

My setup is as followed:

WINDOWS (192.168.255.3) <-> GATEWAY (192.168.255.1, 10.0.0.5) <-> ISPROUTER (10.0.0.1) <-> STEAMLINK (10.0.0.6)

STEAMLINK tries to discover the WINDOWS machine sending a udp packet to the ISPROUTER provided network (10.0.0.0/24) the GATEWAY receives that packet and my intention was for it to DNAT it to WINDOWS (192.168.255.0/24).

On the gateway I have the following configuration:

/etc/network/interfaces

auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

auto lan
iface lan inet static
 bridge-ports eth1 eth2 eth3
 bridge-stp 0
 address 192.168.255.1
 netmask 255.255.255.0
 up sysctl net.ipv4.ip_forward=1
 up /etc/init.d/iptables start

/etc/iptables/rules-save

*filter
# XXX
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

-A INPUT -i lan -p udp --dport 67:68 --sport 67:68 -j ACCEPT
-A INPUT -i lan -p udp --dport 53 -j ACCEPT

-A FORWARD -i eth0 -o lan -j ACCEPT
-A FORWARD -i lan -o eth0 -j ACCEPT
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-A PREROUTING -p udp --dport 27036 -j LOG --log-level warning --log-prefix "XXX: PREROUTING: "
-A POSTROUTING -p udp --dport 27036 -j LOG --log-level warning --log-prefix "YYY: POSTROUTING: "

-A PREROUTING -p udp -i eth0 --dport 27036 -j DNAT --to-destination 192.168.255.3:27036

-A POSTROUTING -o eth0 -j MASQUERADE

COMMIT
gateway:~# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

To test my setup I run the following commands:

tcpdump -i eth0 udp port 27036 # see packet coming in from ISPROUTER
tcpdump -i lan udp port 27036 # expect to see packet forwarded here (when they are sent to WINDOWS)
dmesg -wH # tailing dmesg to see iptables -j LOG

I can see the packet coming in from ISPROUTER to GATEWAY's eth0 and I can see iptables logs for PREROUTING:

[  +7.002404] XXX: PREROUTING: IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:xx:xx:xx:xx:xx:xx:08:00 SRC=10.0.0.6 DST=10.0.0.255 LEN=58 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=55332 DPT=27036 LEN=38 
11:13:03.117913 IP 10.0.0.6.55332 > 10.0.0.255.27036: UDP, length 30

however I cannot see the packets leaving the GATEWAY on the lan bridge (via tcpdump).

What have I done wrong? how can I successfully port forward packets coming from the STEAMLINK to WINDOWS and back?

Thanks

9
  • 1
    You probably can't do this with iptables and netfilter's conntrack: conntrack, which doesn't know much about routing, barely knows enough to ignore a broadcast when doing NAT. Else the reverse (reply) NAT would have a broadcast source which is forbidden (and is what happened when I used tc to force the type to host to test this). Also if you edited the MAC= field, you're not helping with the question. This field looks invalid. There are probably other methods to do this: tc, nftables or also using a bridge and ebtables. – A.B Jun 22 '20 at 12:58
  • Hey A.B, thanks for the reply. I have indeed nullified the MAC address, will update the question to clarify that. Is it relevant for the question? Do you have any recommendation as to what to look for regarding the other methods you posted? (specifically what do you referrer to by "tc") – DDani Jun 22 '20 at 14:24
  • tldp.org/HOWTO/Traffic-Control-HOWTO/index.html . Quite complex – A.B Jun 22 '20 at 14:31
  • You should add the IP addresses and subnet sizes of all involved interfaces to the question. Does STEAMLINK send the UDP packet to a broadcast address (it seems that is how A.B has understood your question)? – Hauke Laging Jun 22 '20 at 16:53
  • So it seems that you should indeed restore the MAC= field. I guess you could use MAC=ff:ff:ff:ff:ff:ff:xx:xx:xx:xx:xx:xx:08:00 if it really started with 6xff... if it didn't then use MAC=yy:yy:yy:yy:yy:yy:xx:xx:xx:xx:xx:xx:08:00 . That's enough to understand if it's really a broadcast (and bridged by ISProuter) or not. Doesn't prevent to put all IP addresses and netmasks too in the schematic. – A.B Jun 22 '20 at 18:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.