UDP DNAT Problem

UDP DNAT Problem

[Craig Packard]

[-- Attachment #1: Type: text/plain, Size: 1031 bytes --]

From what I understand if I setup a DNAT rule, when a packet matching the rule comes in it is sent to the specified host, obviously this is done by changing the destination field to be the system 'behind' the firewall.  It was however my understanding--and what I've seen in practice--that the source field would not be changed.  So in other words the source of the packet would still be the host out on the internet that actually sent the original packet.  However I have made a set of DNAT rules that I couldn't get to work. So a setup a packet sniffer at several points.  Here is what I noticed and has me confused.

The inside computer (A) sends out a UDP packet to the internet connected computer (B), of course this packet goes through firewall (FW).

The packet goes out as expect srcA dstB
But the weird part is the response comes back in srcFW dst(A)   Where I would like it would be src(B) dst(A)!!!

I think this is screwing up the communications.  Can anyone help me understand what is happening?

-    Craig

[-- Attachment #2: Type: text/html, Size: 1853 bytes --]

Re: UDP DNAT Problem

[Ralf Spenneberg]

Am Fre, 2003-04-04 um 05.14 schrieb Craig Packard:

> The packet goes out as expect srcA dstB
> But the weird part is the response comes back in srcFW dst(A)   Where I would like it would be src(B) dst(A)!!!
Are you sure, that you do not have any SNAT rule that might be
responsible?
Post your PRE- and POSTROUTING chains.

Cheers,

Ralf
> 
> I think this is screwing up the communications.  Can anyone help me understand what is happening?
> 
> -    Craig
-- 
Ralf Spenneberg
RHCE, RHCX

IPsec/PPTP Kernels for Red Hat Linux:  
http://www.spenneberg.com/.net/.org/.de
Honeynet Project Mirror:                http://honeynet.spenneberg.org
Snort Mirror:                           http://snort.spenneberg.org

Re: UDP DNAT Problem

[Craig Packard]

On 4 Apr 2003, Ralf Spenneberg wrote:

> Am Fre, 2003-04-04 um 05.14 schrieb Craig Packard:
> 
> > The packet goes out as expect srcA dstB
> > But the weird part is the response comes back in srcFW dst(A)   Where I would like it would be src(B) dst(A)!!!
> Are you sure, that you do not have any SNAT rule that might be
> responsible?
> Post your PRE- and POSTROUTING chains.
> 

Thanks a TON for any help.  Have been stuck on this for a week!

Here is the chains. (I changed the last number in the internet IP to * to 
slightly hide my location.)  On my box it of course shows my proper 
outside address.



[root@linux1 firewall_rules]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       udp  --  anywhere             
acs-24-154-175-*.zoominternet.netudp dpt:5198 to:192.168.25.11:5198
DNAT       udp  --  anywhere             
acs-24-154-175-*.zoominternet.netudp dpt:5199 to:192.168.25.11:5199

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Re: UDP DNAT Problem

[Søren Kent Jensen]

Try http://www.zelow.no/floppyfw/

Regards
Søren Kent Jensen

----- Original Message -----
From: "Craig Packard" <cpackard@zoominternet.net>
To: "Ralf Spenneberg" <lists@spenneberg.org>
Cc: "Netfilter" <netfilter@lists.netfilter.org>
Sent: Friday, March 07, 2003 5:47 PM
Subject: Re: UDP DNAT Problem


> On 4 Apr 2003, Ralf Spenneberg wrote:
>
> > Am Fre, 2003-04-04 um 05.14 schrieb Craig Packard:
> >
> > > The packet goes out as expect srcA dstB
> > > But the weird part is the response comes back in srcFW dst(A)   Where
I would like it would be src(B) dst(A)!!!
> > Are you sure, that you do not have any SNAT rule that might be
> > responsible?
> > Post your PRE- and POSTROUTING chains.
> >
>
> Thanks a TON for any help.  Have been stuck on this for a week!
>
> Here is the chains. (I changed the last number in the internet IP to * to
> slightly hide my location.)  On my box it of course shows my proper
> outside address.
>
>
>
> [root@linux1 firewall_rules]# iptables -t nat -L
> Chain PREROUTING (policy ACCEPT)
> target     prot opt source               destination
> DNAT       udp  --  anywhere
> acs-24-154-175-*.zoominternet.netudp dpt:5198 to:192.168.25.11:5198
> DNAT       udp  --  anywhere
> acs-24-154-175-*.zoominternet.netudp dpt:5199 to:192.168.25.11:5199
>
> Chain POSTROUTING (policy ACCEPT)
> target     prot opt source               destination
> MASQUERADE  all  --  anywhere             anywhere
>
> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
>
>
>