Forward UDP packets to VM on another IP

Question

I'm connected to internet via a router and want to route UDP packets on a port, let's say 3000 to a VM inside KVM.

┌──────────────────┐    
│ router           │
│ 54.0.0.1 (public)│
│ 192.168.0.1      │
└────────┬─────────┘
         │
         │
  ┌──────▼──────┐
  │ pc          │
  │ 192.168.0.2 │
  │ 10.0.0.1    │
  │ ┌────────┐  │
  │ │vm      │  │
  │ │10.0.0.2│  │
  │ └────────┘  │
  │             │
  └─────────────┘

I have opened port 3000 on my router and forwarded all udp packets to 192.168.0.2:3000, and from there I've added:

sudo iptables -t nat -A PREROUTING -d 192.168.0.2 -p UDP --dport 3000 -j DNAT --to 10.0.0.2:3000

However this doesn't work as expected, meaning if I run:

# on VM
$ nc -l -u -p 3000

# from another machine
$ nc 54.0.0.1 3000 -u -v

I'm not able to make a connection and exchange data. Closest thing I've got to this working is having output stage:

sudo iptables -t nat -A OUTPUT -d 192.168.0.2 -p UDP --dport 3000 -j DNAT --to 10.0.0.2:3000

and then if I nc 192.168.0.2 3000 -u -v on local machine, I'll get connected to VM. I can already see through tcpdump that packets from outside network are indeed delivered to 192.168.0.2:3000 so I don't know why this doesn't work fully. (from internet all the way to vm)

score 0 · Answer 1 · answered Dec 02 '22 at 18:35

Did you enable IPv4 forwarding on the PC? If its stopping there that's probably why.

Also you shouldn't need an OUTPUT chain rule in iptables; the PREROUTING is sufficient.

I replicated your steps basically like this:

┌──────────────────┐    
│ Another Machine  │
│ 192.168.146.129  │
└────────┬─────────┘
         │
         │
  ┌──────▼──────────┐
  │ pc              │
  │ 192.168.146.132 │
  │ 10.0.3.1        │
  │ ┌──────────┐    │
  │ │vm        │    │
  │ │10.0.3.100│    │
  │ └──────────┘    │
  │                 │
  └─────────────────┘

On VM:

# Start listener
nc -l -u -p 3000

On PC:

# Add Port Forwarding rule
sudo iptables -t nat -A PREROUTING -d 192.168.146.132 -p udp --dport 3000 -j DNAT --to-destination 10.0.3.100:3000

# Enable IPv4 forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Monitor traffic
sudo tcpdump -nni any udp port 3000

On other machine:

# Connect
192.168.146.132 3000 -u -v

Worked just fine with that for me:

nc 192.168.146.132 3000 -u -v
192.168.146.132: inverse host lookup failed: Unknown host
(UNKNOWN) [192.168.146.132] 3000 (?) open
^C

Forward UDP packets to VM on another IP

1 Answers1