From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Craig Packard" Subject: UDP DNAT Problem Date: Thu, 3 Apr 2003 22:14:53 -0500 Sender: netfilter-admin@lists.netfilter.org Message-ID: <000f01c2fa58$5cd5b290$0b19a8c0@rock1> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_000C_01C2FA2E.73D677B0" Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: To: netfilter@lists.netfilter.org This is a multi-part message in MIME format. ------=_NextPart_000_000C_01C2FA2E.73D677B0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable >From what I understand if I setup a DNAT rule, when a packet matching = the rule comes in it is sent to the specified host, obviously this is = done by changing the destination field to be the system 'behind' the = firewall. It was however my understanding--and what I've seen in = practice--that the source field would not be changed. So in other words = the source of the packet would still be the host out on the internet = that actually sent the original packet. However I have made a set of = DNAT rules that I couldn't get to work. So a setup a packet sniffer at = several points. Here is what I noticed and has me confused. The inside computer (A) sends out a UDP packet to the internet connected = computer (B), of course this packet goes through firewall (FW). The packet goes out as expect srcA dstB But the weird part is the response comes back in srcFW dst(A) Where I = would like it would be src(B) dst(A)!!! I think this is screwing up the communications. Can anyone help me = understand what is happening? - Craig ------=_NextPart_000_000C_01C2FA2E.73D677B0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

From what I understand if I setup a = DNAT rule, when=20 a packet matching the rule comes in it is sent to the specified host, = obviously=20 this is done by changing the destination field to be the system 'behind' = the=20 firewall. It was however my understanding--and what I've seen in=20 practice--that the source field would not be changed. So in other = words=20 the source of the packet would still be the host out on the internet = that=20 actually sent the original packet. However I have made a set of = DNAT rules=20 that I couldn't get to work. So a setup a packet sniffer at several=20 points. Here is what I noticed and has me confused.

The inside computer (A) sends out a UDP = packet to=20 the internet connected computer (B), of course this packet goes through = firewall=20 (FW).

The packet goes out as expect srcA=20 dstB

But the weird part is the = response comes=20 back in srcFW dst(A) Where I would like it would be src(B)=20 dst(A)!!!

I think this is screwing up the=20 communications. Can anyone help me understand what is=20 happening?

- Craig

------=_NextPart_000_000C_01C2FA2E.73D677B0-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ralf Spenneberg Subject: Re: UDP DNAT Problem Date: 04 Apr 2003 10:56:08 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <1049446568.1868.34.camel@kermit.spenneberg.de> References: <000f01c2fa58$5cd5b290$0b19a8c0@rock1> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <000f01c2fa58$5cd5b290$0b19a8c0@rock1> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="us-ascii" To: Netfilter Am Fre, 2003-04-04 um 05.14 schrieb Craig Packard: > The packet goes out as expect srcA dstB > But the weird part is the response comes back in srcFW dst(A) Where I would like it would be src(B) dst(A)!!! Are you sure, that you do not have any SNAT rule that might be responsible? Post your PRE- and POSTROUTING chains. Cheers, Ralf > > I think this is screwing up the communications. Can anyone help me understand what is happening? > > - Craig -- Ralf Spenneberg RHCE, RHCX IPsec/PPTP Kernels for Red Hat Linux: http://www.spenneberg.com/.net/.org/.de Honeynet Project Mirror: http://honeynet.spenneberg.org Snort Mirror: http://snort.spenneberg.org From mboxrd@z Thu Jan 1 00:00:00 1970 From: Craig Packard Subject: Re: UDP DNAT Problem Date: Fri, 7 Mar 2003 10:47:44 -0500 (EST) Sender: netfilter-admin@lists.netfilter.org Message-ID: References: <1049446568.1868.34.camel@kermit.spenneberg.de> Mime-Version: 1.0 Return-path: In-Reply-To: <1049446568.1868.34.camel@kermit.spenneberg.de> Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: TEXT/PLAIN; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Ralf Spenneberg Cc: Netfilter On 4 Apr 2003, Ralf Spenneberg wrote: > Am Fre, 2003-04-04 um 05.14 schrieb Craig Packard: > > > The packet goes out as expect srcA dstB > > But the weird part is the response comes back in srcFW dst(A) Where I would like it would be src(B) dst(A)!!! > Are you sure, that you do not have any SNAT rule that might be > responsible? > Post your PRE- and POSTROUTING chains. > Thanks a TON for any help. Have been stuck on this for a week! Here is the chains. (I changed the last number in the internet IP to * to slightly hide my location.) On my box it of course shows my proper outside address. [root@linux1 firewall_rules]# iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT udp -- anywhere acs-24-154-175-*.zoominternet.netudp dpt:5198 to:192.168.25.11:5198 DNAT udp -- anywhere acs-24-154-175-*.zoominternet.netudp dpt:5199 to:192.168.25.11:5199 Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?iso-8859-1?Q?S=F8ren_Kent_Jensen?= Subject: Re: UDP DNAT Problem Date: Fri, 4 Apr 2003 18:25:30 +0200 Sender: netfilter-admin@lists.netfilter.org Message-ID: <00c601c2fac6$cf1c4440$0223a8c0@soren> References: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Return-path: Errors-To: netfilter-admin@lists.netfilter.org List-Help: List-Post: List-Subscribe: , List-Id: List-Unsubscribe: , List-Archive: Content-Type: text/plain; charset="iso-8859-1" To: Netfilter Try http://www.zelow.no/floppyfw/ Regards S=F8ren Kent Jensen ----- Original Message ----- From: "Craig Packard" To: "Ralf Spenneberg" Cc: "Netfilter" Sent: Friday, March 07, 2003 5:47 PM Subject: Re: UDP DNAT Problem > On 4 Apr 2003, Ralf Spenneberg wrote: > > > Am Fre, 2003-04-04 um 05.14 schrieb Craig Packard: > > > > > The packet goes out as expect srcA dstB > > > But the weird part is the response comes back in srcFW dst(A) Whe= re I would like it would be src(B) dst(A)!!! > > Are you sure, that you do not have any SNAT rule that might be > > responsible? > > Post your PRE- and POSTROUTING chains. > > > > Thanks a TON for any help. Have been stuck on this for a week! > > Here is the chains. (I changed the last number in the internet IP to * = to > slightly hide my location.) On my box it of course shows my proper > outside address. > > > > [root@linux1 firewall_rules]# iptables -t nat -L > Chain PREROUTING (policy ACCEPT) > target prot opt source destination > DNAT udp -- anywhere > acs-24-154-175-*.zoominternet.netudp dpt:5198 to:192.168.25.11:5198 > DNAT udp -- anywhere > acs-24-154-175-*.zoominternet.netudp dpt:5199 to:192.168.25.11:5199 > > Chain POSTROUTING (policy ACCEPT) > target prot opt source destination > MASQUERADE all -- anywhere anywhere > > Chain OUTPUT (policy ACCEPT) > target prot opt source destination > > >