Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to redirect all incoming traffic on UDP port 5060 to port 56790, and all outgoing traffic from 5060 to the port 56789. I used these iptables rules:

iptables -t nat -I PREROUTING -p udp ! -s localhost --dport 5060 -j REDIRECT --to-port 56790
iptables -t nat -I OUTPUT -p udp ! -s localhost --sport 5060 -j REDIRECT --to-port 56789

I listen on both ports using RAW SOCKETS after setting the interface to PROMISCUOUS mode using ioctl.

I see packets ONLY on 56789 i.e.SENDING side, and I do not see any packets on 56790, while wireshark shows that many packets are delivered to port 5060.

Why would this happen? Any ideas? Do you think it's a problem with iptables rules or something to do with raw sockets?

[This is ubuntu 10.04 and iptables v1.4.4]

share|improve this question
Not sure I understand the question: (1) wireshark will look at packets as they come from the wire, so iptables rules for incoming packets do not apply; (2) your iptables rules apply to UDP, but you state that you open a raw socket. Could you please clarify what you are trying to achieve and what does not work as expected? – Riccardo Murri Oct 19 '10 at 12:24
i am trying to build a transparent proxy for all traffic going in and coming out of port 5060. For that, I added the two iptables rules - one for redirecting incoming traffic, and another for redirecting output traffic. I see that only the outgoing packets are correctly redirected, and the packets for the input chain are NOT getting redirected to the intended port i.e. 56790. I can say so because I am running a simple application (tried both SOCK_RAW and SOCK_DGRAM) listening on port 56790, and it is not receiving any packet. I hope this makes sense. – skypemesm Oct 19 '10 at 12:41
May I see the output of iptables-save? You can obfuscate any public IP address in it. – pepoluan Mar 10 '11 at 11:38

If you want to transparently redirect packets arriving to port 5060/udp to port 56790/udp, then you need two iptables rules for that: one for incoming packets, and one to map reply packets (which have source port 56790) back to remote destination port 5060:

sudo iptables -A PREROUTING -p udp -m udp --dport 5060 -j DNAT --to-destination :56790
sudo iptables -A POSTROUTING -p udp -m udp --sport 56790 -j SNAT --to-source :5060

Conversely, to redirect outgoing packets (originating from port 5060 and intended for port 5060) to port 56789, you swap the port numbers:

sudo iptables -A PREROUTING -p udp -m udp --dport 57689 -j DNAT --to-destination :5060
sudo iptables -A POSTROUTING -p udp -m udp --sport 5060 -j SNAT --to-source :56789
share|improve this answer
And similarly for redirecting all output packets from 5060 through 56789 as : iptables -A POSTROUTING -p udp -m udp --dport 5060 -j DNAT --to-destination :56789 Am I right? I will verify your incoming rules and let you know if they work. Thanks. – skypemesm Oct 19 '10 at 22:39
@skypemesm You just need to swap the port numbers; I've updated the answer text with the outgoing rules. – Riccardo Murri Oct 20 '10 at 7:26
sudo iptables -L -t nat Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT udp -- anywhere anywhere udp dpt:sip to: Chain POSTROUTING (policy ACCEPT) target prot opt source destination SNAT udp -- anywhere anywhere udp spt:56790 to::5060 Chain OUTPUT (policy ACCEPT) target prot opt source destination I have netcat listen on udp port 56790 while i run a sip application. – skypemesm Oct 20 '10 at 10:03
while i see packets coming into my ip adress:5060, I dont receive any packets on 56790. It is the same problem with these rules as well :( – skypemesm Oct 20 '10 at 10:04
@skypesm Weird... I tested the rules with netcat and they worked for me... – Riccardo Murri Oct 20 '10 at 10:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.