I have an UDP application which sends packets with inbound source port numbers equal to the destination port numbers from both sides of the communication. The documentation also states that this application will not work in case Network Address Port Translation (NAPT) is involved. I have verified that this is indeed the case, and also that a NAT, preserving destination AND SOURCE port numbers works correctly, sometimes referred to as "static mode NAT". However, I am attempting to make this application work using NAPT, sometimes also referred to as "hide mode NAT". I thought this would be possible using iptables as follows, on the Ubuntu server side receiving the modified UDP source part numbers :
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 1 -p udp --dport 12000 -j SNAT --to-source :12000
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 2 -p udp --dport 12001 -j SNAT --to-source :12001
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 3 -p udp --dport 12002 -j SNAT --to-source :12002
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 4 -p udp --dport 12003 -j SNAT --to-source :12003
hercules@pjjs12:~$ sudo iptables -t nat -I POSTROUTING 5 -p udp --dport 12004 -j SNAT --to-source :12004
When I run the application, tcpdump shows that this is however not working. Also iptables -L
commands show that the rules are apparently not being used :
hercules@pjjs12:~$ sudo iptables -vxnL -t nat --line-numbers
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 SNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:12000 to::12000
2 0 0 SNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:12001 to::12001
3 0 0 SNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:12002 to::12002
4 0 0 SNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:12003 to::12003
5 0 0 SNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:12004 to::12004
hercules@pjjs12:~$ sudo iptables -vxnL --line-numbers
Chain INPUT (policy ACCEPT 542660 packets, 30600115 bytes)
num pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 1838 packets, 100767 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 562972 packets, 888057717 bytes)
num pkts bytes target prot opt in out source destination
hercules@pjjs12:~$
I must admit that this is my first attempt to use iptables
so I am not sure at all whether this is possible, or whether I'm overlooking really basic things. An help on this will be greatly appreciated.
Thanks,
Peter