Re: How to use DNAT

[Steven Kath <steven.kath@vyatta.com>]

----- "Italo Valcy" <italo@dcc.ufba.br> wrote: -----
> > Please provide some details about the rule, packets...
> > Note that iptables' NAT ignores packets in the INVALID state.
> 
> Well... so could be this: INVALID state... The packets are about a
> netflow traffic (9996/UDP) comming to the firewall, which should be
> redirected to a internal host (through the DNAT). How can I debug
> these possible INVALID packets?

iptables -I FORWARD -p udp -m udp --dport 9996 -m state --state INVALID -j LOG --log-prefix "INVALID-FWD: " 
iptables -I INPUT -p udp -m udp --dport 9996 -m state --state INVALID -j LOG --log-prefix "INVALID-IN: " 

This will allow you to see matching traffic through the filter 
table's FORWARD and INPUT chains with the invalid state in dmesg. 

Also, bear in mind that the nat table is only consulted for 
packets with state NEW. If your UDP flow state transitions to 
ESTABLISHED before your NAT rule is created, the new rule will 
not be applied to that flow.  

You'd need to clear that connection from the table with 
conntrack-tools, flush the entire table, or let the connection 
expire from the table for it to be considered NEW again and 
compared against the nat rules.