Odd DNAT/Redirect Issue

Murdock1979 · 04-21-2009, 09:48 AM

Hello!

I set up iptables to redirect to a new server. However, only some devices redirect. Others are sent back a 3:3 ICMP message.

This is how the iptables are set up:

Code:

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
DNAT       all  --  anywhere             anywhere            to:181.80.231.240

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Some packets are redirected correctly as follows:

Code:

U 82.81.137.75:5071 -> 115.179.144.342:5060
  REGISTER sip:115.179.144.342 
<SNIP>#
U 115.179.144.342:5071 -> 181.80.231.240:5060
  REGISTER sip:115.179.144.342 SIP/2.0..Via: SIP/2.0/UDP 10.0.0.40:5071;rport;branch=z9hG4bKywreswca..Max-Forwards: 70..To: "mord" <si
  p:120@115.179.144.342>..From: "mord" <sip:120@115.179.144.342>;tag=hnnaf..Call-ID: tqznabweebqdcez@slackware.home..CSeq: 7
  81 REGISTER..Contact: <sip:120@10.0.0.40:5071>;expires=3600..Allow: INVITE,ACK,BYE,CANCEL,OPTIONS,PRACK,REFER,NOTIFY,SUBSCRIBE,INFO,
  MESSAGE..User-Agent: Twinkle/1.3.1..Content-Length: 0....
#

However, others:

Code:

U 79.179.108.33:1028 -> 115.179.144.342:5060
  REGISTER sip:115.179.144.342 

<SNIP>
I 115.179.144.342 -> 79.179.108.33 3:3
  ....E.......6..4O.l!..........jtREGISTER sip:115.179.144.342 SIP/2.0..Via: SIP/2.0/UDP 79.179.108.33:1028;rport;branch=z9hG4bKe99aca
  c099..From: "233" <sip:233@115.179.144.342>;tag=407c5912..To: "233" <sip:233@115.179.144.342>..Call-ID: 5e4235434cb6f20d7ecd5ad35c06
  13ae@10.0.0.151..Contact: <sip:233@79.179.108.33:1028>..CSeq: 1 REGISTER..Max-Forwards: 70..Expires: 60..Allow: INVITE,CANCEL,ACK,BY
  E,NOTIFY,REFER,OPTIONS,INFO,MESSAGE..User-Agent: CM5K  (706070)..Content-Length: 0....

Depending on the source ip, iptables either redirects or seems to send back a 3:3. Why is this happening?

Any help is greatly appreciated!

Murdock

datopdog · 04-22-2009, 04:59 AM

It could be the application generating the ICMP message not the iptables machine. You need to run a dump on both interfaces to see who is issuing the icmp reply.

You could also fine tune your DNAT rule by tieing it to one destination address.

Murdock1979 · 04-22-2009, 06:07 AM

Hello,

Thanks for the suggestion. However, my assumption was correct that some source ip addresses were being redirected while others were not.

I think I found out the problem here:
https://lists.netfilter.org/pipermai...ry/010577.html

Apparently, iptables keeps a cache of all current transmission flows and only redirect new connections. Those devices did not time out their connection so were not being redirected.

Thanks!
Murdock