* does -p udp --dport 5060 not work with -j LOG?
@ 2008-04-30 22:27 sean darcy
2008-05-01 3:23 ` Diego Lacerda
0 siblings, 1 reply; 8+ messages in thread
From: sean darcy @ 2008-04-30 22:27 UTC (permalink / raw)
To: netfilter
I'm trying to figure out why my sip port forwarding doesn't work.
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j DNAT --to
10.10.10.180:5060
$IPT -A FORWARD -p udp -m state --state NEW -d 10.10.10.180 --dport 5060
-j ACCEPT
So before everything I put:
$IPT -t nat -A PREROUTING -i external -p udp --sport 5060 --dport 5060
-j LOG --log-prefix "SIP-BEFORE: "
(I also tried it without --sport.)
But in syslog I get packets both from "lan" my internal interface:
SIP-BEFORE: IN=lan OUT= MAC=01:00:5e:7f:ff:fa:00:15:99:25:e1:32:08:00
SRC=10.10.10.102 DST=239.255.255.250 LEN=364 TOS=0x00 PREC=0x00 TTL=1
ID=33785 PROTO=UDP SPT=1024 DPT=1900 LEN=344
SIP-BEFORE: IN=lan OUT= MAC=01:00:5e:7f:ff:fa:00:15:99:25:e1:32:08:00
SRC=10.10.10.102 DST=239.255.255.250 LEN=372 TOS=0x00 PREC=0x00 TTL=1
ID=33795 PROTO=UDP SPT=1024 DPT=1900 LEN=352
And, from the external interface, it logs all udp ports:
SIP-BEFORE: IN=external OUT=
MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx.yyy.113.22
DST=xxx.yyy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=112 ID=56357
PROTO=UDP SPT=17214 DPT=32375 LEN=106
SIP-BEFORE: IN=external OUT=
MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx.yyy.113.22
DST=xx.yy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=112 ID=56357 PROTO=UDP
SPT=17214 DPT=32375 LEN=106
So any suggestions on port forwarding sip appreciated. I'm disappointed
I can't figure this out myself using -j LOG (:
sean
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: does -p udp --dport 5060 not work with -j LOG?
2008-04-30 22:27 does -p udp --dport 5060 not work with -j LOG? sean darcy
@ 2008-05-01 3:23 ` Diego Lacerda
2008-05-01 23:36 ` sean darcy
0 siblings, 1 reply; 8+ messages in thread
From: Diego Lacerda @ 2008-05-01 3:23 UTC (permalink / raw)
To: sean darcy; +Cc: netfilter
Hi, Sean,
I used to put -j LOG on the end of my filter scripts to debug this
king of problems, because all packets that didn't match with any rule
will be logged (and then dropped, of course).
Do you have any other rule in PREROUTING chain about the same IP address?
Could you please show the results of "iptables -L -n -v -t nat", and
show what rules do you have in filter mathing the "SIP-BEFORE" target
log (something like "iptables -L -n -v |grep SIP-BEFORE")?
I think that this king of information will help us to help you. :-)
Regards,
Diego Lacerda.
On Wed, Apr 30, 2008 at 7:27 PM, sean darcy <seandarcy2@gmail.com> wrote:
> I'm trying to figure out why my sip port forwarding doesn't work.
>
> $IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j DNAT --to 10.10.10.180:5060
> $IPT -A FORWARD -p udp -m state --state NEW -d 10.10.10.180 --dport 5060 -j ACCEPT
>
> So before everything I put:
>
> $IPT -t nat -A PREROUTING -i external -p udp --sport 5060 --dport 5060 -j LOG --log-prefix "SIP-BEFORE: "
>
> (I also tried it without --sport.)
>
> But in syslog I get packets both from "lan" my internal interface:
>
> SIP-BEFORE: IN=lan OUT= MAC=01:00:5e:7f:ff:fa:00:15:99:25:e1:32:08:00 SRC=10.10.10.102 DST=239.255.255.250 LEN=364 TOS=0x00 PREC=0x00 TTL=1 ID=33785 PROTO=UDP SPT=1024 DPT=1900 LEN=344
> SIP-BEFORE: IN=lan OUT= MAC=01:00:5e:7f:ff:fa:00:15:99:25:e1:32:08:00 SRC=10.10.10.102 DST=239.255.255.250 LEN=372 TOS=0x00 PREC=0x00 TTL=1 ID=33795 PROTO=UDP SPT=1024 DPT=1900 LEN=352
>
> And, from the external interface, it logs all udp ports:
>
> SIP-BEFORE: IN=external OUT= MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx.yyy.113.22 DST=xxx.yyy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=112 ID=56357 PROTO=UDP SPT=17214 DPT=32375 LEN=106
> SIP-BEFORE: IN=external OUT= MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx.yyy.113.22 DST=xx.yy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=112 ID=56357 PROTO=UDP SPT=17214 DPT=32375 LEN=106
>
> So any suggestions on port forwarding sip appreciated. I'm disappointed I can't figure this out myself using -j LOG (:
>
> sean
>
> --
> To unsubscribe from this list: send the line "unsubscribe netfilte r" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: does -p udp --dport 5060 not work with -j LOG?
2008-05-01 3:23 ` Diego Lacerda
@ 2008-05-01 23:36 ` sean darcy
2008-05-01 23:53 ` Steven Kath
0 siblings, 1 reply; 8+ messages in thread
From: sean darcy @ 2008-05-01 23:36 UTC (permalink / raw)
To: netfilter
Diego Lacerda wrote:
> Hi, Sean,
>
> I used to put -j LOG on the end of my filter scripts to debug this
> king of problems, because all packets that didn't match with any rule
> will be logged (and then dropped, of course).
> Do you have any other rule in PREROUTING chain about the same IP address?
>
> Could you please show the results of "iptables -L -n -v -t nat", and
> show what rules do you have in filter mathing the "SIP-BEFORE" target
> log (something like "iptables -L -n -v |grep SIP-BEFORE")?
>
> I think that this king of information will help us to help you. :-)
>
> Regards,
> Diego Lacerda.
>
Thanks for the response.
There only one line in my script that uses SIP:
grep SIP firewall-masq
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG
--log-prefix "SIP-BEFORE: "
And it's run first:
sh -x firewall-masq
+ IPT=/sbin/iptables
+ /sbin/iptables -F
+ /sbin/iptables -X
+ /sbin/iptables -t nat -A PREROUTING -i external -p udp --dport 5060 -j
LOG --log-prefix 'SIP-BEFORE: '
...........
I don't really understand this output:
iptables -L -n -v -t nat | grep SIP
2 262 LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
144K 24M LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
41816 5117K LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix
`SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'
And I'm still logging stuff from the lan if, and all udp ports:
May 1 19:33:00 kernel: SIP-BEFORE: IN=lan OUT=
MAC=00:a0:24:54:28:cb:00:0d:56:6b:d7:11:08:00 SRC=10.10.1
0.138 DST=xxx.yyy.1.21 LEN=67 TOS=0x00 PREC=0x00 TTL=128 ID=32656
PROTO=UDP SPT=1233 DPT=53 LEN=47
May 1 19:33:00 kernel: SIP-BEFORE: IN=lan OUT=
MAC=00:a0:24:54:28:cb:00:0d:56:6b:d7:11:08:00 SRC=10.10.1
0.138 DST=xxx.yyy.0.84 LEN=67 TOS=0x00 PREC=0x00 TTL=128 ID=32657
PROTO=UDP SPT=1233 DPT=53 LEN=47
May 1 19:33:00 kernel: SIP-BEFORE: IN=external OUT=
MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx
.yyy.147.90 DST=xxx.yyy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=113
ID=11552 PROTO=UDP SPT=18956 DPT=32375 LEN=106
BTW, this Fedora 6, iptables-1.3.8
sean
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: does -p udp --dport 5060 not work with -j LOG?
2008-05-01 23:36 ` sean darcy
@ 2008-05-01 23:53 ` Steven Kath
2008-05-02 0:45 ` Diego Lacerda
0 siblings, 1 reply; 8+ messages in thread
From: Steven Kath @ 2008-05-01 23:53 UTC (permalink / raw)
To: 'sean darcy', netfilter
>
> There only one line in my script that uses SIP:
>
> grep SIP firewall-masq
> $IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG
> --log-prefix "SIP-BEFORE: "
>
> And it's run first:
>
> sh -x firewall-masq
> + IPT=/sbin/iptables
> + /sbin/iptables -F
> + /sbin/iptables -X
> + /sbin/iptables -t nat -A PREROUTING -i external -p udp --dport 5060 -j
> LOG --log-prefix 'SIP-BEFORE: '
> ...........
>
>
> I don't really understand this output:
>
> iptables -L -n -v -t nat | grep SIP
> 2 262 LOG udp -- * * 0.0.0.0/0
> 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
> '
> 144K 24M LOG udp -- * * 0.0.0.0/0
> 0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
> 41816 5117K LOG udp -- external * 0.0.0.0/0
> 0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
> 0 0 LOG udp -- external * 0.0.0.0/0
> 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
> '
> 0 0 LOG udp -- external * 0.0.0.0/0
> 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
> '
...
It looks like your nat table isn't getting flushed.
Have you tried running 'iptables -t nat -F' before firewall-masq or adding
that to the start of the script?
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: does -p udp --dport 5060 not work with -j LOG?
2008-05-01 23:53 ` Steven Kath
@ 2008-05-02 0:45 ` Diego Lacerda
2008-05-02 1:10 ` sean darcy
0 siblings, 1 reply; 8+ messages in thread
From: Diego Lacerda @ 2008-05-02 0:45 UTC (permalink / raw)
To: Steven Kath; +Cc: 'sean darcy', netfilter
[-- Attachment #1: Type: text/plain, Size: 1961 bytes --]
On Thu, 2008-05-01 at 16:53 -0700, Steven Kath wrote:
> >
> > There only one line in my script that uses SIP:
> >
> > grep SIP firewall-masq
> > $IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG
> > --log-prefix "SIP-BEFORE: "
> >
> > And it's run first:
> >
> > sh -x firewall-masq
> > + IPT=/sbin/iptables
> > + /sbin/iptables -F
> > + /sbin/iptables -X
> > + /sbin/iptables -t nat -A PREROUTING -i external -p udp --dport 5060 -j
> > LOG --log-prefix 'SIP-BEFORE: '
> > ...........
> >
> >
> > I don't really understand this output:
> >
> > iptables -L -n -v -t nat | grep SIP
> > 2 262 LOG udp -- * * 0.0.0.0/0
> > 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
> > '
> > 144K 24M LOG udp -- * * 0.0.0.0/0
> > 0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
> > 41816 5117K LOG udp -- external * 0.0.0.0/0
> > 0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
> > 0 0 LOG udp -- external * 0.0.0.0/0
> > 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
> > '
> > 0 0 LOG udp -- external * 0.0.0.0/0
> > 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
> > '
> ...
>
> It looks like your nat table isn't getting flushed.
>
> Have you tried running 'iptables -t nat -F' before firewall-masq or adding
> that to the start of the script?
Yeah,
I think that you really need flush the NAT table before.
In this case you can see that the second and third rules in you NAT table are logging every UDP packet (you can see that by first and second columns: packets/bytes).
Regards,
--
Diego Evaristo de Lacerda (diegolacerda@gmail.com)
Project Analyst
LPIC Level III & Redhat Certified Engineer & Cisco Certified Network
Associates
URL: conectado.motime.com
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: does -p udp --dport 5060 not work with -j LOG?
2008-05-02 0:45 ` Diego Lacerda
@ 2008-05-02 1:10 ` sean darcy
2008-05-02 1:40 ` Steven Kath
2008-05-02 13:34 ` Jan Engelhardt
0 siblings, 2 replies; 8+ messages in thread
From: sean darcy @ 2008-05-02 1:10 UTC (permalink / raw)
To: netfilter
Diego Lacerda wrote:
> On Thu, 2008-05-01 at 16:53 -0700, Steven Kath wrote:
>>> There only one line in my script that uses SIP:
>>>
>>> grep SIP firewall-masq
>>> $IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG
>>> --log-prefix "SIP-BEFORE: "
>>>
>>> And it's run first:
>>>
>>> sh -x firewall-masq
>>> + IPT=/sbin/iptables
>>> + /sbin/iptables -F
>>> + /sbin/iptables -X
>>> + /sbin/iptables -t nat -A PREROUTING -i external -p udp --dport 5060 -j
>>> LOG --log-prefix 'SIP-BEFORE: '
>>> ...........
>>>
>>>
>>> I don't really understand this output:
>>>
>>> iptables -L -n -v -t nat | grep SIP
>>> 2 262 LOG udp -- * * 0.0.0.0/0
>>> 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
>>> '
>>> 144K 24M LOG udp -- * * 0.0.0.0/0
>>> 0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
>>> 41816 5117K LOG udp -- external * 0.0.0.0/0
>>> 0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
>>> 0 0 LOG udp -- external * 0.0.0.0/0
>>> 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
>>> '
>>> 0 0 LOG udp -- external * 0.0.0.0/0
>>> 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
>>> '
>> ...
>>
>> It looks like your nat table isn't getting flushed.
>>
>> Have you tried running 'iptables -t nat -F' before firewall-masq or adding
>> that to the start of the script?
>
> Yeah,
>
> I think that you really need flush the NAT table before.
> In this case you can see that the second and third rules in you NAT table are logging every UDP packet (you can see that by first and second columns: packets/bytes).
>
> Regards,
>
Wow. That worked.
I always thought iptables -F flushed all the tables. Is there a command
that does flush all the tables? Cleans the slate completely?
sean
^ permalink raw reply [flat|nested] 8+ messages in thread
* RE: does -p udp --dport 5060 not work with -j LOG?
2008-05-02 1:10 ` sean darcy
@ 2008-05-02 1:40 ` Steven Kath
2008-05-02 13:34 ` Jan Engelhardt
1 sibling, 0 replies; 8+ messages in thread
From: Steven Kath @ 2008-05-02 1:40 UTC (permalink / raw)
To: 'sean darcy', netfilter
Sean darcy wrote:
> Wow. That worked.
>
> I always thought iptables -F flushed all the tables. Is there a command
> that does flush all the tables? Cleans the slate completely?
>
The 'filter' table is the default if no -t argument is specified, so only
the filter table gets flushed with iptables -F.
The closest thing I can imagine to a clean slate is flushing all the
built-in tables by name, restoring the default policy for each table to
ACCEPT, and running iptables -X to delete all user-generated tables:
iptables -t nat -F
iptables -t nat -P ACCEPT
iptables -t raw -F
iptables -t raw -P ACCEPT
iptables -t mangle -F
iptables -t mangle -P ACCEPT
iptables -t filter -F
iptables -t filter -P ACCEPT
iptables -X
'-t filter' is redundant as it's the default but I showed it here for
clarity.
Maybe there's an argument that's shorthand for some or all of this, but
I'm not aware of one.
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: does -p udp --dport 5060 not work with -j LOG?
2008-05-02 1:10 ` sean darcy
2008-05-02 1:40 ` Steven Kath
@ 2008-05-02 13:34 ` Jan Engelhardt
1 sibling, 0 replies; 8+ messages in thread
From: Jan Engelhardt @ 2008-05-02 13:34 UTC (permalink / raw)
To: sean darcy; +Cc: netfilter
On Friday 2008-05-02 03:10, sean darcy wrote:
>
> Wow. That worked.
>
> I always thought iptables -F flushed all the tables. Is there a command that
> does flush all the tables? Cleans the slate completely?
iptables-restore. It's even faster in applying rules and almost
always preferrable to raw iptables commands.
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2008-05-02 13:34 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-04-30 22:27 does -p udp --dport 5060 not work with -j LOG? sean darcy
2008-05-01 3:23 ` Diego Lacerda
2008-05-01 23:36 ` sean darcy
2008-05-01 23:53 ` Steven Kath
2008-05-02 0:45 ` Diego Lacerda
2008-05-02 1:10 ` sean darcy
2008-05-02 1:40 ` Steven Kath
2008-05-02 13:34 ` Jan Engelhardt
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.