0

I have a rather unusual network setup. It starts with a vps on the internet. Up for years, never connectivity problems. On it, I installed my ip-networkstack-in-userspace ("MyIP" from now on; it is already running somewhere else on the internet serving sip and http so it works, at least good enough for the basics).

Now I would like to redirect any UDP port 161 traffic coming in via eth0 on the vps to the virtual network-interface. For some reason the usual iptables-rules don't work; tcpdump shows no traffic on the virtual interface and also the ip-stack ("MyIP") shows no signs of receiving anything (not even ARP).

internet -> vps[eth0, 37.34.63.177] -> vps[myip, 192.168.4.1] -> MyIP[myip, 192.168.4.2]

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j LOG --log-prefix "DNAT: " --log-level 0                                   
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j DNAT --to 192.168.4.2:161                                                 
iptables -A FORWARD -d 192.168.4.2 -p udp --dport 161 -j LOG --log-prefix "FWD: " --log-level 0                                         
iptables -A FORWARD -d 192.168.4.2 -p udp --dport 161 -j ACCEPT    
iptables -A INPUT -i eth0 -p udp --destination-port 161 -j ACCEPT                                                                     

Now if I tcpdump on eth0, I see the requests coming in. tcpdump on the 'myip'-network interface shows nothing. dmesg also nothing and iptables -t nat -L -n -v shows no increasing counters.

So either it is not possible to forward packets to a virtual network interface (this would affect VPNs) or my iptables-rules are wrong. Anyone has an idea?

(don't think it is an MTU problem as the packets are less than 200 bytes usually)

6
  • 1
    You're appending rules. Are you sure there aren't REJECT/DROP rules from a previous set of rules? (iptables -nvL and iptables -t nat -nvL)
    – roaima
    Sep 1, 2021 at 15:27
  • 1
    Yes I'm sure. In fact I also tried without any other rules (-F INPUT etc) and with the default policy (still) on ACCEPT. Sep 1, 2021 at 15:28
  • Is IP forwarding enabled on the VPS? sysctl net.ipv4.ip_forward Sep 1, 2021 at 16:29
  • Yes, yes forwarding is enabled. Sep 1, 2021 at 17:28
  • 1
    Debugging started with tcpdump can continue with asking the kernel about the route it would choose: ip route get from 192.0.2.2 ipproto udp dport 161 iif eth0 to 192.168.4.2 . Is there any error? Is the output interface the expected one? (the ipproto udp dport 161 part requires a recent kernel and is only here to catch policy routing rules if any, just remove it if there's a syntax error)
    – A.B
    Sep 1, 2021 at 18:14

1 Answer 1

0

This assumes that you have already wiped the broken rules and taken care of SSH rules in the INPUT chain

Your DNAT statement should look like this:

iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j LOG --log-prefix "DNAT: " --log-level 0                      
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 161 -j DNAT --to 192.168.4.2:161

                                

Your FORWARD statement should look like this:

iptables -A FORWARD -d 37.34.63.177 -p udp --dport 161 -j LOG --log-prefix "FWD: " --log-level 0                         
iptables -A FORWARD -d 37.34.63.177 -p udp --dport 161 -j ACCEPT 

And finally allow return traffic:

iptables -A FORWARD -o eth0 -p udp -s 192.168.4.2 --sport 161 -m state --state RELATED,ESTABLISHED -j ACCEPT

You really don't need an INPUT statement for DNAT to work

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.