I'm trying to accomplish simple packet forwarding on an Ubuntu 14.04 server (IP=192.168.36.217) using iptables. I want to take incoming packets destined to the server on a particular port and rewrite them to a new destination, with a specified port (HTTPS) and a source IP set to this server and source port set up with NAT, so it can be reversed on return packets.
Tables mangle, raw and security are empty. All rules of all tables have a default of ACCEPT. I have 1 DNAT rule in PREROUTING and 1 SNAT rule in POSTROUTING. Then I added some LOG rules just to check what was happening. Here are what tables nat and filter look like:
filter Table
Chain INPUT (policy ACCEPT 249 packets, 15888 bytes)
num pkts bytes target prot opt in out source destination
1 143 8348 LOG tcp -- * * 10.15.4.115 0.0.0.0/0 LOG flags 0 level 4 prefix "l++: INP of interest: "
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 169 packets, 12148 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 LOG tcp -- * * 0.0.0.0/0 45.45.45.45 LOG flags 0 level 4 prefix "l++: filter\OUTPUT : "
nat Table
Chain PREROUTING (policy ACCEPT 2762 packets, 279K bytes)
num pkts bytes target prot opt in out source destination
1 33 1672 LOG tcp -- * * 10.15.4.115 0.0.0.0/0 tcp dpt:65001 LOG flags 0 level 4 prefix "l++: nat PRE "
2 15 760 DNAT tcp -- * * 10.15.4.115 0.0.0.0/0 tcp dpt:65001 to:45.45.45.45:45001
3 0 0 LOG tcp -- * * 10.15.4.115 0.0.0.0/0 LOG flags 0 level 4 prefix "l++: nat PRE BOT"
Chain INPUT (policy ACCEPT 263 packets, 46239 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 LOG all -- * * 10.15.4.115 0.0.0.0/0 LOG flags 0 level 4 prefix "l++: nat INP: "
Chain OUTPUT (policy ACCEPT 60 packets, 4285 bytes)
num pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 60 packets, 4285 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 LOG tcp -- * * 10.15.4.115 0.0.0.0/0 LOG flags 0 level 4 prefix "l++: nat POST end: "
2 0 0 SNAT tcp -- * em1 10.15.4.115 0.0.0.0/0 to:192.168.36.217
3 0 0 LOG tcp -- * em1 192.168.36.217 0.0.0.0/0 LOG flags 0 level 4 prefix "l++: nat POST after SNAT: "
4 0 0 LOG tcp -- * em1 10.15.4.115 0.0.0.0/0 LOG flags 0 level 4 prefix "l++: nat POST after SNAT what"
When I test (from 10.15.4.115: telnet 192.168.36.217 65001), this is all I see in the system message log:
May 19 15:20:40 LDAP-Proxy kernel: [1891508.926283] l++: nat PRE IN=em1 OUT=
MAC=<omitted> SRC=10.15.4.115 DST=192.168.36.217 LEN=52 TOS=0x00 PREC=0x00
TTL=127 ID=21164 DF PROTO=TCP SPT=59394 DPT=65001 WINDOW=64512 RES=0x00 SYN
URGP=0
I believe I have the PREROUTING rule boxed in with LOG rules. The packet comes in, gets to the DNAT rule and promptly vanishes.
I will gladly receive any suggestions, ideas, wild guesses on this misbehavior. Thank you!
cat /proc/sys/net/ipv4/ip_forward
? The packets seem to be sent to 45.45.45.45, not 192.168.36.217