Disable port translation in SNAT

Disable port translation in SNAT

[James Lamanna]

Hi,
Is there a way to disable port translation during SNAT so that traffic
originates from the same external port as it did internally?
I realize that this might be able to be done with a separate SNAT rule for
each port, but I have a port range of 50 or so (RTP) so I'm wondering if
it's possible to do on a range basis.

Thanks.

--James

Re: Disable port translation in SNAT

[Pascal Hambourg]

Hello,

James Lamanna a écrit :
> Hi,
> Is there a way to disable port translation during SNAT so that traffic
> originates from the same external port as it did internally?

When possible this is already the default when you don't specify a port
range nor --random. From the man page :

--to-source  ipaddr[-ipaddr][:port-port]
     which  can  specify a single new source IP address, an inclusive
     range of IP addresses, and optionally, a port  range  (which  is
     only  valid if the rule also specifies -p tcp or -p udp).	 If no
     port range is specified, then source ports  below	 512  will  be
     mapped  to  other	 ports	below  512: those between 512 and 1023
     inclusive will be mapped to ports below 1024,  and  other	 ports
     will  be mapped to 1024 or above. Where possible, no port alter-
     ation will occur.

Sometimes the source port must be translated in order to avoid a
conflict with an existing connection to the same destination which
already uses that source port.

Re: Disable port translation in SNAT

[James Lamanna]

Hi,
I have one device (an IP phone) on an AirRouter (based on linux, uses iptables).
it still is translating ports in the 16000 range all the way down to 1025, which breaks RTP (it apparently doens't have very good SIP/SDP 
conn-tracking on it).

That's why I was a bit puzzled as to why it keeps translating the ports down to the low 1000s. I had thought it was the default to preserve it.

-- James


On 7/24/2014 2:43 PM, Pascal Hambourg wrote:
> Hello,
>
> James Lamanna a écrit :
>> Hi,
>> Is there a way to disable port translation during SNAT so that traffic
>> originates from the same external port as it did internally?
>
> When possible this is already the default when you don't specify a port
> range nor --random. From the man page :
>
> --to-source  ipaddr[-ipaddr][:port-port]
>       which  can  specify a single new source IP address, an inclusive
>       range of IP addresses, and optionally, a port  range  (which  is
>       only  valid if the rule also specifies -p tcp or -p udp).	 If no
>       port range is specified, then source ports  below	 512  will  be
>       mapped  to  other	 ports	below  512: those between 512 and 1023
>       inclusive will be mapped to ports below 1024,  and  other	 ports
>       will  be mapped to 1024 or above. Where possible, no port alter-
>       ation will occur.
>
> Sometimes the source port must be translated in order to avoid a
> conflict with an existing connection to the same destination which
> already uses that source port.
>

Re: Disable port translation in SNAT

[Pascal Hambourg]

James Lamanna a écrit :
> Hi,
> I have one device (an IP phone) on an AirRouter (based on linux, uses iptables).
> it still is translating ports in the 16000 range all the way down to 1025,
> which breaks RTP (it apparently doens't have very good SIP/SDP 
> conn-tracking on it).

Can you indicate the kernel version running on that router, and the
exact SNAT rule ?