Redirecting incoming packets to other port

Redirecting incoming packets to other port

[Holger Kinkelin]

Hello everybody

how can I redirect packets sent to my computer to another port?

I tried: iptables -A PREROUTING -t nat -p udp --dport 5060 --sport
5060 -j DNAT --to-destination 192.168.0.21:5063

This rule is accepted but doesn't do anything. There are no other
rules that could cause side effects.

Regards,
Holger

Re: Redirecting incoming packets to other port

[Brent Clark]

Holger Kinkelin wrote:
> Hello everybody
> 
> how can I redirect packets sent to my computer to another port?
> 
> I tried: iptables -A PREROUTING -t nat -p udp --dport 5060 --sport
> 5060 -j DNAT --to-destination 192.168.0.21:5063
> 
> This rule is accepted but doesn't do anything. There are no other
> rules that could cause side effects.
> 
> Regards,
> Holger


http://www.linuxtopia.org/Linux_Firewall_iptables/x4508.html

HTH

Kind Regards
Brent Clark

Re: Redirecting incoming packets to other port

[Holger Kinkelin]

Hello,
no this doesn't seem to work.

I can REDIRECT packets sent BY my computer, not packets sent TO it. Is
there maybe another posibility?

Regards,
Holger

PS: Thanks to Brent for his reply

2006/10/11, Brent Clark <bclark@eccotours.co.za>:
> Holger Kinkelin wrote:
> > Hello everybody
> >
> > how can I redirect packets sent to my computer to another port?
> >
> > I tried: iptables -A PREROUTING -t nat -p udp --dport 5060 --sport
> > 5060 -j DNAT --to-destination 192.168.0.21:5063
> >
> > This rule is accepted but doesn't do anything. There are no other
> > rules that could cause side effects.
> >
> > Regards,
> > Holger
>
>
> http://www.linuxtopia.org/Linux_Firewall_iptables/x4508.html
>
> HTH
>
> Kind Regards
> Brent Clark
>
>

Re: Redirecting incoming packets to other port

[Cedric Blancher]

Le mercredi 11 octobre 2006 à 10:09 +0200, Holger Kinkelin a écrit :
> I tried: iptables -A PREROUTING -t nat -p udp --dport 5060 --sport
> 5060 -j DNAT --to-destination 192.168.0.21:5063
> This rule is accepted but doesn't do anything. There are no other
> rules that could cause side effects.

Is your filtering ruleset consistent with this ? I.e. are theses packets
allowed by a FORWARD or INPUT rule ? If you want to redirect traffic to
your host, you can give a try to REDIRECT target.


-- 
http://sid.rstack.org/
PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
>> Hi! I'm your friendly neighbourhood signature virus.
>> Copy me to your signature file and help me spread!

Re: Redirecting incoming packets to other port

[Brent Clark]

Holger Kinkelin wrote:
> Hello,
> no this doesn't seem to work.
> 
> I can REDIRECT packets sent BY my computer, not packets sent TO it. Is
> there maybe another posibility?
> 
> Regards,
> Holger
> 
> PS: Thanks to Brent for his reply

Hi

Only a pleasure.

Lets take a working example.
When you want to create a Transparent Proxy. Traffic gets sent to port 80, to the site in question.

You, on your firewall /router redirect to port 3128, or what ever you choose to have squid to run on.

So are you sure you have your service running on port 5053 as opposed to 5060.

Is this really for SIP.

Brent

P.s. You may want to share your ruleset.

Re: Redirecting incoming packets to other port

[Mohammad Farooq]

On Wed, 2006-10-11 at 10:09 +0200, Holger Kinkelin wrote:
> Hello everybody
> 
> how can I redirect packets sent to my computer to another port?
> 
> I tried: iptables -A PREROUTING -t nat -p udp --dport 5060 --sport
> 5060 -j DNAT --to-destination 192.168.0.21:5063
> 
> This rule is accepted but doesn't do anything. There are no other
> rules that could cause side effects.
> 
> Regards,
> Holger
> 
> 
Make sure forwarding is turn on on your box. Execute the following
command:
echo 1 > /proc/sys/net/ipv4/ip_forward

MF

Re: Redirecting incoming packets to other port

[Holger Kinkelin]

Hi Brent, hi others

> Is this really for SIP.
Yes, it's definately for SIP. I try to create some sort of transparent
sip proxy that I will use later for monitoring packets for a project /
for my thesis.

The thing I want to do is the following

1. redirect traffic from the client to my proxy
--> iptables -A OUTPUT -t nat -p udp --dport 5060 --sport 5060 -j
REDIRECT --to-ports 5061
The proxy waits on 5061 for this traffic, the packets do arrive. Step
1 is working.

2. Now the proxy collects some info from the packets and sends them
(unchanged) out on 5062 to the server. I need a second rule that
changes the source port from 5062 back to 5060 that the SIP server
doesn't notice the proxy
--> iptables -A POSTROUTING -t nat -p udp --dport 5060 --sport 5062 -j
SNAT --to-source 192.168.0.21:5060
192.168.0.21 is the IP of the PC where the client and proxy are
running on. That's working, too. The packets get sent to the server
using the correct ports, the server accepts the packets and replies
correctly. BUT NOW I think the problem occurs! When the reply from the
server arrives on the proxy computer, a "ICMP destination port
unreachable" is sent back to the server. Why? I don't get this.

Has anybody an idea how to fix this problem or how to do the whole
proxy differently?

Regards,
Holger