I want to understand how to set up broadcasting correctly for old games. In particular, I'm interested in the game Warcraft 3, which runs on the local network and searches only for those games that are on the subnet.

My task is to make it possible to run the game on Linux and Windows systems as if it were on a local network

Initial data:

  • Local interface: eth0
  • Local address:
  • VPN interface: tun0
  • VPN address:
  • Game port: 6112

Right now I have a working solution that looks strange:

  • I launch Warcraft 3 and make a local game inside, it goes up to
  • Making a routing rule
    ip route add dev tun0
  • I'm making a rule to change the broadcast source
    iptables -tnat -A POSTROUTING -p udp -m udp --dport 6112 -j SNAT --to-source

And voila, the game appears inside the client's local network

Is there a solution in this case that is more reliable and not so "strange"? It confuses me that I have to redirect all to the tun0 interface

1 Answer 1


I looked for a solution to my problem in iptables, but as it turned out it could not help me. In one online chat I was told to delve into nfttables and after several hours I found this solution

Creates 2 tables for INPUT and OUTPUT in the MANGLE chain

nft 'add chain ip mangle OUTPUT { type filter hook output priority  150; policy accept; }'
nft 'add chain ip mangle INPUT { type filter hook input priority  150; policy accept; }'`

Duplicate traffic to another interface

nft add rule mangle INPUT iifname eth0 ip daddr udp dport 6112 meta mark set 2 dup to device tun0

It takes traffic from the local network interface (eth0), makes sure that the receiving address is from the broadcast ( and goes to port 6112, if the condition is true, then it marks it as “2” and sends it to the address, only to the VPN(tun0) interface.

At this stage, we are already starting to see the necessary traffic on the devices in the VPN, only the source address will be equal to the source of the local network. So let's fix this:

nft add rule mangle OUTPUT oifname tun0 meta mark 2 counter ip saddr set

Here we make sure that traffic from the tun0 interface with label “2” replaces the source address with an address on the VPN network. If this is not done, then when accessing via broadcast the traffic will go to the address of its local network

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .