iptables DNAT of outgoing destination port, unexpected behavior


Login or Register for Dates, Times and to Reply

 
Thread Tools Search this Thread
# 1  
iptables DNAT of outgoing destination port, unexpected behavior

Not sure if this should be here or in the security section.

I am developing software that dynamically manipulates netfilter/iptables rules (through system() calls of the command strings, I'm not trying to hack the netfilter code). Basically, UDP messages that are sent by an application on, say, port 55555, I have some rules that DNAT that port to some other port calculated from a time and key based algorithm. That port is recalculated every couple of seconds, and the DNAT rule is replaced. The idea here is to have to port number hop periodically.

This all appeared to be working fine, iptables lists showing the DNAT rule changing exactly as expected, until I saw traffic getting through that shouldn't (I'm sending multiple datagrams per second), so I fired up wireshark. What I noticed is this - when the first message goes out, the destination port nicely gets translated to the calculated port. But, after this, when the DNAT rule is dynamically changed, the traffic going across the network (between virtual machines in this experiment) continues to show the first calculated destination port.

I also have noticed that if I stop sending for at least 30 seconds and then restart, the messages start to go out using the port number appropriate for this new time slot. Also, if I stop and restart the sending program, it also picks the first correct DNATed destination port and sticks on that one.

So what appears to be happening here is that there is some persistence to that DNAT first port assignment even though I change the DNAT rule. The persistence appears on both ends, because the recipient is running a parallel algorithm for its DNAT rules that should only be allowing the calculated port but also seems to permit passages on this first calculated port as long as they come no less than 30 seconds apart. After 30 seconds, or after stop and restart of the sending app, the persistence is broken (only to be re-established on the next calculated port number).

I don't understand what is causing this persistence - do "established connections" also apply to UDP traffic? Is there a way to eliminate this persistence, or at least make it a much shorter time?

Here's an example of how I set up the rules (executed programmatically with system()):

Code:
iptables -t nat -N dport-dnat
iptables -t nat -A dport-dnat -p udp --dport 55555 -j DNAT --to-destination :51279
iptables -t nat -I OUTPUT -p udp -j dport-dnat

then in accordance with my timers something like this will be executed:

Code:
iptables -t nat -R dport-dnat -p udp --dport 55555 -j DNAT --to-destination :52871

I always check status, I'm not getting any errors on the calls.

Thanks for any clues.

Last edited by Scrutinizer; 05-22-2012 at 03:07 AM.. Reason: code tags
Login or Register for Dates, Times and to Reply

Previous Thread | Next Thread
Thread Tools Search this Thread
Search this Thread:
Advanced Search

Test Your Knowledge in Computers #815
Difficulty: Medium
In CSS, E[foo] matches an E element with a 'foo' class name.
True or False?

10 More Discussions You Might Find Interesting

1. Red Hat

iptables help for port 80

Hi I enable the IPtables but port 80 was not working. Below is my active configuration (10 Replies)
Discussion started by: ranjancom2000
10 Replies

2. Shell Programming and Scripting

Unexpected Echo Behavior

Hello all, I have a basic issue that I can't seem to search for since I'm not sure how to describe the behavior. Could anyone kindly assist the novice? (Sample) File Data: bundle-ppp-1/1.78 bundle-ppp-1/2.80 bundle-ppp-1/1.79 bundle-ppp-1/2.81 bundle-ppp-1/1.80 bundle-ppp-1/2.82... (6 Replies)
Discussion started by: sjrupp
6 Replies

3. UNIX for Dummies Questions & Answers

Launchd-owned processes unexpected behavior

Ok, so I have been struggling with this for a few days and I think I need an explanation of a few things before I go any further. I'm not sure it's possible to do what I'm trying, so before I pull my hair out, here is what I'm doing: I have written a program in LiveCode that sits on our... (2 Replies)
Discussion started by: nextyoyoma
2 Replies

4. UNIX for Advanced & Expert Users

unexpected behavior bash, set -o vi, history -a, and HISTFILE

I am trying to get my history in sync in multiple bash sections and things aren't working the way I expect. Desired behavior, hitting esc-K in all bash sessions (same userid and machine) will use the same history. Observed behavior: Esc-k shows the history of the current session, rather than... (8 Replies)
Discussion started by: gg48gg
8 Replies

5. Red Hat

Open port with iptables

Hi, What iptables command do I need to run in order to open up the following port for incomming traffic on the following server: # telnet 127.0.0.1 1521 Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection refused telnet: Unable to connect to remote host: Connection... (3 Replies)
Discussion started by: Duffs22
3 Replies

6. IP Networking

blocking traffic to destination network by port

I am trying to block ALL traffic except when from ports 9100,22,23 to destination network 192.0.0.0 (my WAN): 2 networks 192.0.3.0 with static route to 192.0.0.0 Shouldn't this work?: iptables -A INPUT -p tcp -d 192.0.0.0/24 --dport 22 -j ACCEPT iptables -A INPUT -p tcp -d 192.0.0.0/24... (3 Replies)
Discussion started by: herot
3 Replies

7. UNIX for Advanced & Expert Users

Ip And Port Divertion Through Iptables

Hi To All, I want to Route my web application to Mysql Database through a proxy server.so for this which approach should i use 1)iptables 2)squid if Iptables how can i make this worked .this is the ip network i'm having web application---------Proxy server-----------------Mysql Database... (0 Replies)
Discussion started by: kgrvamsi
0 Replies

8. Fedora

Using iptables to allow only certain IPs for a Port

Hi.. Anyone can help me..I have setup my linux fedora server and i want to restrict access to my server.Basically i control using iptables.I'm not sure how to write an iptables rules to control drop all connection to port 8080 and allow only certain ip can access the instance on port 8080 example... (0 Replies)
Discussion started by: netxus
0 Replies

9. Red Hat

DNAT in RHEL 4

dear all i have 3 networks say A, B and C. Network A - 192.168.65.0/24 Network B - 172.192.100.0/24 (Linux Servers) Network C - 192.168.200.0/24 (NMS Server) Net A can access Net B, but Net A can not access Net C directily, Net B can access Net C, i want to access Net C from Net A via Net... (1 Reply)
Discussion started by: surfer24
1 Replies

10. Solaris

Unexpected df behavior

Hi, I have Sun SPARC Enterprise T5140 with two 2,5" 15rpm 146GB SAS HDD. In friday there were a lot of errors with fs on them. After reconfiguring all seemed to be fine but today I get the following strange behavior of df -kh command and troubles with files, I written on first disk in friday.... (9 Replies)
Discussion started by: Sapfeer
9 Replies

Featured Tech Videos