0

I have a rather unusual network setup. It starts with a vps on the internet. Up for years, never connectivity problems. On it, I installed my ip-networkstack-in-userspace ("MyIP" from now on; it is already running somewhere else on the internet serving sip and http so it works, at least good enough for the basics).

Now I would like to redirect any UDP port 161 traffic coming in via eth0 on the vps to the virtual network-interface. For some reason the usual iptables-rules don't work; tcpdump shows no traffic on the virtual interface and also the ip-stack ("MyIP") shows no signs of receiving anything (not even ARP).

internet -> vps[eth0, 37.34.63.177] -> vps[myip, 192.168.4.1] -> MyIP[myip, 192.168.4.2]

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j LOG --log-prefix "DNAT: " --log-level 0                                   
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j DNAT --to 192.168.4.2:161                                                 
iptables -A FORWARD -d 192.168.4.2 -p udp --dport 161 -j LOG --log-prefix "FWD: " --log-level 0                                         
iptables -A FORWARD -d 192.168.4.2 -p udp --dport 161 -j ACCEPT    
iptables -A INPUT -i eth0 -p udp --destination-port 161 -j ACCEPT                                                                     

Now if I tcpdump on eth0, I see the requests coming in. tcpdump on the 'myip'-network interface shows nothing. dmesg also nothing and iptables -t nat -L -n -v shows no increasing counters.

So either it is not possible to forward packets to a virtual network interface (this would affect VPNs) or my iptables-rules are wrong. Anyone has an idea?

(don't think it is an MTU problem as the packets are less than 200 bytes usually)

6
  • 1
    You're appending rules. Are you sure there aren't REJECT/DROP rules from a previous set of rules? (iptables -nvL and iptables -t nat -nvL) Commented Sep 1, 2021 at 15:27
  • 1
    Yes I'm sure. In fact I also tried without any other rules (-F INPUT etc) and with the default policy (still) on ACCEPT. Commented Sep 1, 2021 at 15:28
  • Is IP forwarding enabled on the VPS? sysctl net.ipv4.ip_forward Commented Sep 1, 2021 at 16:29
  • Yes, yes forwarding is enabled. Commented Sep 1, 2021 at 17:28
  • 1
    Debugging started with tcpdump can continue with asking the kernel about the route it would choose: ip route get from 192.0.2.2 ipproto udp dport 161 iif eth0 to 192.168.4.2 . Is there any error? Is the output interface the expected one? (the ipproto udp dport 161 part requires a recent kernel and is only here to catch policy routing rules if any, just remove it if there's a syntax error)
    – A.B
    Commented Sep 1, 2021 at 18:14

1 Answer 1

0

This assumes that you have already wiped the broken rules and taken care of SSH rules in the INPUT chain

Your DNAT statement should look like this:

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j LOG --log-prefix "DNAT: " --log-level 0                      
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j DNAT --to 192.168.4.2:161

                                

Your FORWARD statement should look like this:

iptables -A FORWARD -d 37.34.63.177 -p udp --dport 161 -j LOG --log-prefix "FWD: " --log-level 0                         
iptables -A FORWARD -d 37.34.63.177 -p udp --dport 161 -j ACCEPT 

And finally allow return traffic:

iptables -A FORWARD -o eth0 -p udp -s 192.168.4.2 --sport 161 -m state --state RELATED,ESTABLISHED -j ACCEPT

You really don't need an INPUT statement for DNAT to work

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .