snmptraps incomming on udp port 162 REDIRECT to 4162 not working?

snmptraps incomming on udp port 162 REDIRECT to 4162 not working?

[Ben Russo]

Hi,

I have a server that performs many functions on a testing/lab network.
I don't really need a firewall, but I do want to restrict users from
having root access.

Sometimes users want to be able to bind a process to a low port like say
an snmptrap receiver to port 162, but the process needs privelages to do
that.

So I had the bright idea of using iptables to redirect the incomming
packets on the low port to a high port that the users program can bind
to without problems.

I tried the following:

iptables -t nat -p udp -m udp --dport 162 -j REDIRECT --to-ports 4162

The user started his program that bound to udp port 4162 (I could see it
while using netstat -nap ).  But his program didn't receive anything?
tcpdump -n | egrep "snmptrap|162 
did show incomming snmptraps to port 162, but "icmp unreachable" replies
were sent back?

Any ideas on how to make this work?

Thanks in advance,
-Ben.

Re: snmptraps incomming on udp port 162 REDIRECT to 4162 not working?

[Joel Newkirk]

On Tuesday 05 November 2002 11:16 am, Ben Russo wrote:
>
> I tried the following:
>
> iptables -t nat -p udp -m udp --dport 162 -j REDIRECT --to-ports 4162

iptables -t nat -A PREROUTING -p udp --dport 162 -j REDIRECT --to-ports 4162

should redirect all incoming for port 162 to port 4162.  You needed to specify 
what chain in the nat table (IE, PREROUTING to catch them as they first hit 
the firewall).  If it still fails then make sure you are allowing packets for 
port 4162 through the INPUT chain of the filter table, since that's where 
they should pass, and the dport they should indicate.

j

Re: snmptraps incomming on udp port 162 REDIRECT to 4162 not working?

[Antony Stone]

On Tuesday 05 November 2002 4:16 pm, Ben Russo wrote:

> Hi,
>
> I tried the following:
>
> iptables -t nat -p udp -m udp --dport 162 -j REDIRECT --to-ports 4162
>
> Any ideas on how to make this work?

You should have a "-A PREROUTING" in there.   I'm not sure about the "-m udp" 
- I presume this is something to do with loading modules for different 
protocol support ?   (I don't use modules, but I've seen this sort of thing 
in other people's rules before.)

Antony.

-- 

Documentation is like sex:
when it's good, it's very very good;
when it's bad, it's still better than nothing.

Re: snmptraps incomming on udp port 162 REDIRECT to 4162 not working?

[Ben Russo]

On Tue, 2002-11-05 at 13:29, Antony Stone wrote:
> On Tuesday 05 November 2002 4:16 pm, Ben Russo wrote:
> 
> > Hi,
> >
> > I tried the following:
> >
> > iptables -t nat -p udp -m udp --dport 162 -j REDIRECT --to-ports 4162
> >
> > Any ideas on how to make this work?
> 
> You should have a "-A PREROUTING" in there.   I'm not sure about the "-m udp" 
> - I presume this is something to do with loading modules for different 
> protocol support ?   (I don't use modules, but I've seen this sort of thing 
> in other people's rules before.)
> 
> Antony.

Thanks Antony and Joel,

I'm sorry I was a little confusing there... I had the "-A PREROUTING" in
there when I typed it on the host, just not in the e-mail I sent to the
list.  Hopefully this will clear it up a little.... It still doesn't
seem to work, but here is the output of the "iptables-save"

# Generated by iptables-save v1.2.5 on Mon Nov  4 16:06:52 2002
*nat
:PREROUTING ACCEPT [11:2077]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -p udp -m udp --dport 162 -j REDIRECT --to-ports 4162
COMMIT
# Completed on Mon Nov  4 16:06:52 2002
# Generated by iptables-save v1.2.5 on Mon Nov  4 16:06:52 2002
*filter
:INPUT ACCEPT [1814:266793]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1073:147564]
COMMIT
# Completed on Mon Nov  4 16:06:52 2002

-Ben.