0

I'm trying to accomplish simple packet forwarding on an Ubuntu 14.04 server (IP=192.168.36.217) using iptables. I want to take incoming packets destined to the server on a particular port and rewrite them to a new destination, with a specified port (HTTPS) and a source IP set to this server and source port set up with NAT, so it can be reversed on return packets.

Tables mangle, raw and security are empty. All rules of all tables have a default of ACCEPT. I have 1 DNAT rule in PREROUTING and 1 SNAT rule in POSTROUTING. Then I added some LOG rules just to check what was happening. Here are what tables nat and filter look like:

filter Table

Chain INPUT (policy ACCEPT 249 packets, 15888 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      143  8348 LOG        tcp  --  *      *       10.15.4.115          0.0.0.0/0            LOG flags 0 level 4 prefix "l++: INP of interest: "

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 169 packets, 12148 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        tcp  --  *      *       0.0.0.0/0            45.45.45.45          LOG flags 0 level 4 prefix "l++: filter\OUTPUT : "

nat Table

Chain PREROUTING (policy ACCEPT 2762 packets, 279K bytes)
num   pkts bytes target     prot opt in     out     source               destination
1       33  1672 LOG        tcp  --  *      *       10.15.4.115          0.0.0.0/0            tcp dpt:65001 LOG flags 0 level 4 prefix "l++: nat PRE "
2       15   760 DNAT       tcp  --  *      *       10.15.4.115          0.0.0.0/0            tcp dpt:65001 to:45.45.45.45:45001
3        0     0 LOG        tcp  --  *      *       10.15.4.115          0.0.0.0/0            LOG flags 0 level 4 prefix "l++: nat PRE BOT"

Chain INPUT (policy ACCEPT 263 packets, 46239 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        all  --  *      *       10.15.4.115          0.0.0.0/0            LOG flags 0 level 4 prefix "l++: nat INP: "

Chain OUTPUT (policy ACCEPT 60 packets, 4285 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 60 packets, 4285 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 LOG        tcp  --  *      *       10.15.4.115          0.0.0.0/0            LOG flags 0 level 4 prefix "l++: nat POST end: "
2        0     0 SNAT       tcp  --  *      em1     10.15.4.115          0.0.0.0/0            to:192.168.36.217
3        0     0 LOG        tcp  --  *      em1     192.168.36.217       0.0.0.0/0            LOG flags 0 level 4 prefix "l++: nat POST after SNAT: "
4        0     0 LOG        tcp  --  *      em1     10.15.4.115          0.0.0.0/0            LOG flags 0 level 4 prefix "l++: nat POST after SNAT what"

When I test (from 10.15.4.115: telnet 192.168.36.217 65001), this is all I see in the system message log:

May 19 15:20:40 LDAP-Proxy kernel: [1891508.926283] l++: nat PRE IN=em1 OUT=  
MAC=<omitted> SRC=10.15.4.115 DST=192.168.36.217 LEN=52 TOS=0x00 PREC=0x00 
TTL=127 ID=21164 DF PROTO=TCP SPT=59394 DPT=65001 WINDOW=64512 RES=0x00 SYN 
URGP=0

I believe I have the PREROUTING rule boxed in with LOG rules. The packet comes in, gets to the DNAT rule and promptly vanishes.

I will gladly receive any suggestions, ideas, wild guesses on this misbehavior. Thank you!

  • Just to note: my traffic must come in and depart on the same NIC, em1. – Kevin Buchs May 19 '16 at 21:37
  • Do you have forwarding enabled? cat /proc/sys/net/ipv4/ip_forward? The packets seem to be sent to 45.45.45.45, not 192.168.36.217 – Doug Smythies May 19 '16 at 22:27
  • @DougSmythies - yes that was the problem exactly. ip_forward was not set. Want to put that in an answer for credit? – Kevin Buchs May 20 '16 at 15:24
1

In addition to a proper iptables rule set, forwarding needs to be enabled in the kernel. Check the current setting (which defaults to disabled):

cat /proc/sys/net/ipv4/ip_forward

And if it disabled (0) then it can be enabled (non persistent) via:

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

or (still non persistent) via:

sudo sysctl -w net.ipv4.ip_forward=1

For a persistent setting (after the next re-boot), edit as sudo the file /etc/sysctl.conf and change this line:

# Uncomment the next line to enable packet forwarding for IPv4
#net.ipv4.ip_forward=1

To this:

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
  • This was the issue. Thanks Doug!. I also needed to recognize that when Prerouting hits a DNAT and Postrouting a SNAT, the packet immediately exits that chain. Therefore LOGing after those rules will not be triggered. – Kevin Buchs May 22 '16 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.