Score:1

How To Translate UDP Source Port Numbers Using Iptables

jp flag

I have an UDP application which sends packets with inbound source port numbers equal to the destination port numbers from both sides of the communication. The documentation also states that this application will not work in case Network Address Port Translation (NAPT) is involved. I have verified that this is indeed the case, and also that a NAT, preserving destination AND SOURCE port numbers works correctly, sometimes referred to as "static mode NAT". However, I am attempting to make this application work using NAPT, sometimes also referred to as "hide mode NAT". I thought this would be possible using iptables as follows, on the Ubuntu server side receiving the modified UDP source part numbers :

hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 1 -p udp --dport 12000 -j SNAT --to-source :12000
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 2 -p udp --dport 12001 -j SNAT --to-source :12001
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 3 -p udp --dport 12002 -j SNAT --to-source :12002
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 4 -p udp --dport 12003 -j SNAT --to-source :12003
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 5 -p udp --dport 12004 -j SNAT --to-source :12004

When I run the application, tcpdump shows that this is however not working. Also iptables -L commands show that the rules are apparently not being used :

hercules@pjjs12:~$ sudo iptables -vxnL -t nat --line-numbers
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num      pkts      bytes target     prot opt in     out     source               destination         
1           0        0 SNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:12000 to::12000
2           0        0 SNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:12001 to::12001
3           0        0 SNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:12002 to::12002
4           0        0 SNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:12003 to::12003
5           0        0 SNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:12004 to::12004
hercules@pjjs12:~$ sudo iptables -vxnL --line-numbers
Chain INPUT (policy ACCEPT 542660 packets, 30600115 bytes)
num      pkts      bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 1838 packets, 100767 bytes)
num      pkts      bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 562972 packets, 888057717 bytes)
num      pkts      bytes target     prot opt in     out     source               destination         
hercules@pjjs12:~$ 

I must admit that this is my first attempt to use iptables so I am not sure at all whether this is possible, or whether I'm overlooking really basic things. An help on this will be greatly appreciated.

Thanks,

Peter

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.