portforwarding to virtual host not possible?

Question

I have a rather unusual network setup. It starts with a vps on the internet. Up for years, never connectivity problems. On it, I installed my ip-networkstack-in-userspace ("MyIP" from now on; it is already running somewhere else on the internet serving sip and http so it works, at least good enough for the basics).

Now I would like to redirect any UDP port 161 traffic coming in via eth0 on the vps to the virtual network-interface. For some reason the usual iptables-rules don't work; tcpdump shows no traffic on the virtual interface and also the ip-stack ("MyIP") shows no signs of receiving anything (not even ARP).

internet -> vps[eth0, 37.34.63.177] -> vps[myip, 192.168.4.1] -> MyIP[myip, 192.168.4.2]

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j LOG --log-prefix "DNAT: " --log-level 0                                   
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j DNAT --to 192.168.4.2:161                                                 
iptables -A FORWARD -d 192.168.4.2 -p udp --dport 161 -j LOG --log-prefix "FWD: " --log-level 0                                         
iptables -A FORWARD -d 192.168.4.2 -p udp --dport 161 -j ACCEPT    
iptables -A INPUT -i eth0 -p udp --destination-port 161 -j ACCEPT                                                                     

Now if I tcpdump on eth0, I see the requests coming in. tcpdump on the 'myip'-network interface shows nothing. dmesg also nothing and iptables -t nat -L -n -v shows no increasing counters.

So either it is not possible to forward packets to a virtual network interface (this would affect VPNs) or my iptables-rules are wrong. Anyone has an idea?

(don't think it is an MTU problem as the packets are less than 200 bytes usually)

Answer 1

This assumes that you have already wiped the broken rules and taken care of SSH rules in the INPUT chain

Your DNAT statement should look like this:

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j LOG --log-prefix "DNAT: " --log-level 0                      
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j DNAT --to 192.168.4.2:161

                                

Your FORWARD statement should look like this:

iptables -A FORWARD -d 37.34.63.177 -p udp --dport 161 -j LOG --log-prefix "FWD: " --log-level 0                         
iptables -A FORWARD -d 37.34.63.177 -p udp --dport 161 -j ACCEPT 

And finally allow return traffic:

iptables -A FORWARD -o eth0 -p udp -s 192.168.4.2 --sport 161 -m state --state RELATED,ESTABLISHED -j ACCEPT

You really don't need an INPUT statement for DNAT to work