5

I'm trying to create redirection for syslog UDP traffic from incoming IP:PORT to other port on same linux box. Purpose for that is to route traffic comming to different IP addresses on server to services running on higher port numbers depending on destination address.

OS: RHEL 7.2

Rule:

iptables -A PREROUTING -t nat -p udp --dport 514 -d A.D.D.R -j REDIRECT --to-port 1514

for debugging i tested also:

iptables -A PREROUTING -t nat -p udp --dport 514 -d A.D.D.R -j LOG --log-prefix "SYSLOG_REDIRECT"

iptables -t nat -L -v -n

shows 0 for counter, no logs recorded

tcpdump shows traffic incoming on ingress port 514

destination IP address (A.D.D.R) is assigned to subinterface/alias interface enoXXXX:1

Does someone had similar case?

mrbeat
  • 53
  • 1
  • 3

1 Answers1

1

Your NAT rule seems to be correct and should do what you expected. However, there is one point to verify that I believe it is the reason why your UDP traffic is not redirected.

Redirecting UDP traffic can be more trickier than redirecting TCP. This is mainly because TCP is a connection-oriented protocol and UDP is connection-less.

NAT rules rely on connection tracking module which keeps track of the state of any "connection". In TCP case, it is clear what it means as there is special TCP packets to indicate new connections. In UDP, there is no connection establishment phase. The first packet your box will see it is considered as initiating a "connection" and the reply packet indicates that the "connection is established".

How about closing the connection? In TCP, it is also clear because TCP uses special flags to indication connection close. When seen, you box can make use of them and clear the connection state accordingly. However, you will never know when UDP "connection" is terminated. So, the connection track entry will not be cleared unless the timeout is reached (on my machine it is set to 180 seconds) without any UDP packet.

How this is related to your issue? When your box is continuously receiving UDP traffic for syslog, the UDP "connection" timeout will not expire and the connection state will be kept all the time. NAT rule will not be applied as long as there is a state in connection tracking table.

How to force new NAT rule? You can try to remove the connection tracking entry manually using the below command (don't use it without any other parameters as it will empty the whole table interrupting all your current connections). For more parameters, you can check the manual.

$ sudo conntrack -D
Khaled
  • 36,533
  • 8
  • 72
  • 99
  • Thank You Khaled, Your response helped me finding solution and it was not related to iptables finally, some hard to find miscofiguration of application was reason why traffic was not seen in expected place. – mrbeat Sep 29 '17 at 06:37
  • It was missleading that iptables counters was not increased when traffic was going thorugh. – mrbeat Sep 29 '17 at 15:59