does -p udp --dport 5060 not work with -j LOG?
I'm trying to figure out why my sip port forwarding doesn't work.
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j DNAT --to 10.10.10.180:5060 $IPT -A FORWARD -p udp -m state --state NEW -d 10.10.10.180 --dport 5060 -j ACCEPT
So before everything I put:
$IPT -t nat -A PREROUTING -i external -p udp --sport 5060 --dport 5060 -j LOG --log-prefix "SIP-BEFORE: "
(I also tried it without --sport.)
But in syslog I get packets both from "lan" my internal interface:
SIP-BEFORE: IN=lan OUT= MAC=01:00:5e:7f:ff:fa:00:15:99:25:e1:32:08:00 SRC=10.10.10.102 DST=239.255.255.250 LEN=364 TOS=0x00 PREC=0x00 TTL=1 ID=33785 PROTO=UDP SPT=1024 DPT=1900 LEN=344 SIP-BEFORE: IN=lan OUT= MAC=01:00:5e:7f:ff:fa:00:15:99:25:e1:32:08:00 SRC=10.10.10.102 DST=239.255.255.250 LEN=372 TOS=0x00 PREC=0x00 TTL=1 ID=33795 PROTO=UDP SPT=1024 DPT=1900 LEN=352
And, from the external interface, it logs all udp ports:
SIP-BEFORE: IN=external OUT= MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx.yyy.113.22 DST=xxx.yyy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=112 ID=56357 PROTO=UDP SPT=17214 DPT=32375 LEN=106 SIP-BEFORE: IN=external OUT= MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx.yyy.113.22 DST=xx.yy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=112 ID=56357 PROTO=UDP SPT=17214 DPT=32375 LEN=106
So any suggestions on port forwarding sip appreciated. I'm disappointed I can't figure this out myself using -j LOG (:
sean
Hi, Sean,
I used to put -j LOG on the end of my filter scripts to debug this king of problems, because all packets that didn't match with any rule will be logged (and then dropped, of course).
Do you have any other rule in PREROUTING chain about the same IP address?
Could you please show the results of "iptables -L -n -v -t nat", and show what rules do you have in filter mathing the "SIP-BEFORE" target log (something like "iptables -L -n -v |grep SIP-BEFORE")?
I think that this king of information will help us to help you. :-)
Regards,
Diego Lacerda.
Quoted 30 lines · sean darcy
I'm trying to figure out why my sip port forwarding doesn't work.
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j DNAT --to 10.10.10.180:5060 $IPT -A FORWARD -p udp -m state --state NEW -d 10.10.10.180 --dport 5060 -j ACCEPT
So before everything I put:
$IPT -t nat -A PREROUTING -i external -p udp --sport 5060 --dport 5060 -j LOG --log-prefix "SIP-BEFORE: "
(I also tried it without --sport.)
But in syslog I get packets both from "lan" my internal interface:
SIP-BEFORE: IN=lan OUT= MAC=01:00:5e:7f:ff:fa:00:15:99:25:e1:32:08:00 SRC=10.10.10.102 DST=239.255.255.250 LEN=364 TOS=0x00 PREC=0x00 TTL=1 ID=33785 PROTO=UDP SPT=1024 DPT=1900 LEN=344 SIP-BEFORE: IN=lan OUT= MAC=01:00:5e:7f:ff:fa:00:15:99:25:e1:32:08:00 SRC=10.10.10.102 DST=239.255.255.250 LEN=372 TOS=0x00 PREC=0x00 TTL=1 ID=33795 PROTO=UDP SPT=1024 DPT=1900 LEN=352And, from the external interface, it logs all udp ports:
SIP-BEFORE: IN=external OUT= MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx.yyy.113.22 DST=xxx.yyy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=112 ID=56357 PROTO=UDP SPT=17214 DPT=32375 LEN=106 SIP-BEFORE: IN=external OUT= MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx.yyy.113.22 DST=xx.yy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=112 ID=56357 PROTO=UDP SPT=17214 DPT=32375 LEN=106So any suggestions on port forwarding sip appreciated. I'm disappointed I can't figure this out myself using -j LOG (:
sean
--
To unsubscribe from this list: send the line "unsubscribe netfilte r" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 7 lines · Diego Lacerda
Hi, Sean,
I used to put -j LOG on the end of my filter scripts to debug this king of problems, because all packets that didn't match with any rule will be logged (and then dropped, of course).
Do you have any other rule in PREROUTING chain about the same IP address?
Quoted 9 lines
Could you please show the results of "iptables -L -n -v -t nat", and show what rules do you have in filter mathing the "SIP-BEFORE" target log (something like "iptables -L -n -v |grep SIP-BEFORE")?
I think that this king of information will help us to help you. :-)
Regards,
Diego Lacerda.
Thanks for the response.
There only one line in my script that uses SIP:
grep SIP firewall-masq
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG --log-prefix "SIP-BEFORE: "
And it's run first:
sh -x firewall-masq
+ IPT=/sbin/iptables
+ /sbin/iptables -F
+ /sbin/iptables -X
+ /sbin/iptables -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG --log-prefix 'SIP-BEFORE: '
...........
I don't really understand this output:
iptables -L -n -v -t nat | grep SIP
2 262 LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
144K 24M LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
41816 5117K LOG udp -- external * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp spt:5060 dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: '
0 0 LOG udp -- external * 0.0.0.0/0 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'
And I'm still logging stuff from the lan if, and all udp ports:
May 1 19:33:00 kernel: SIP-BEFORE: IN=lan OUT= MAC=00:a0:24:54:28:cb:00:0d:56:6b:d7:11:08:00 SRC=10.10.1 0.138 DST=xxx.yyy.1.21 LEN=67 TOS=0x00 PREC=0x00 TTL=128 ID=32656 PROTO=UDP SPT=1233 DPT=53 LEN=47 May 1 19:33:00 kernel: SIP-BEFORE: IN=lan OUT= MAC=00:a0:24:54:28:cb:00:0d:56:6b:d7:11:08:00 SRC=10.10.1 0.138 DST=xxx.yyy.0.84 LEN=67 TOS=0x00 PREC=0x00 TTL=128 ID=32657 PROTO=UDP SPT=1233 DPT=53 LEN=47 May 1 19:33:00 kernel: SIP-BEFORE: IN=external OUT= MAC=00:48:54:8b:ab:29:00:1a:e2:84:bf:3b:08:00 SRC=xxx
.yyy.147.90 DST=xxx.yyy.167.178 LEN=126 TOS=0x04 PREC=0x00 TTL=113 ID=11552 PROTO=UDP SPT=18956 DPT=32375 LEN=106
BTW, this Fedora 6, iptables-1.3.8
sean
Quoted 29 lines
There only one line in my script that uses SIP:
grep SIP firewall-masq
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG --log-prefix "SIP-BEFORE: "And it's run first:
sh -x firewall-masq
+ IPT=/sbin/iptables
+/sbin/iptables-F
+/sbin/iptables-X
+/sbin/iptables-t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG --log-prefix 'SIP-BEFORE: '
...........I don't really understand this output:
iptables -L -n -v -t nat | grep SIP
2 262 LOG udp -- * * 0.0.0.0/00.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'
144K 24M LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
41816 5117K LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
Quoted 6 lines
0 0 LOG udp -- external * 0.0.0.0/0 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: ' 0 0 LOG udp -- external * 0.0.0.0/00.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'
...
It looks like your nat table isn't getting flushed.
Have you tried running 'iptables -t nat -F' before firewall-masq or adding that to the start of the script?
Quoted 34 lines · Steven Kath
Quoted 28 lines
There only one line in my script that uses SIP:
grep SIP firewall-masq
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG --log-prefix "SIP-BEFORE: "And it's run first:
sh -x firewall-masq
+ IPT=/sbin/iptables
+/sbin/iptables-F
+/sbin/iptables-X
+/sbin/iptables-t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG --log-prefix 'SIP-BEFORE: '
...........I don't really understand this output:
iptables -L -n -v -t nat | grep SIP
2 262 LOG udp -- * * 0.0.0.0/00.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'
144K 24M LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
41816 5117K LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: 'Quoted 6 lines
0 0 LOG udp -- external * 0.0.0.0/0 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: ' 0 0 LOG udp -- external * 0.0.0.0/00.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'
Quoted 6 lines
...
It looks like your nat table isn't getting flushed.
Have you tried running 'iptables -t nat -F' before firewall-masq or adding that to the start of the script?
Yeah,
I think that you really need flush the NAT table before.
In this case you can see that the second and third rules in you NAT table are logging every UDP packet (you can see that by first and second columns: packets/bytes).
Regards,
Signature · 6 lines
Diego Evaristo de Lacerda ([email protected]) Project Analyst LPIC Level III & Redhat Certified Engineer & Cisco Certified Network Associates URL: conectado.motime.com
Quoted 41 lines · Diego Lacerda
Quoted 33 lines · Steven Kath
Quoted 27 lines
There only one line in my script that uses SIP:
grep SIP firewall-masq
$IPT -t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG --log-prefix "SIP-BEFORE: "And it's run first:
sh -x firewall-masq
+ IPT=/sbin/iptables
+/sbin/iptables-F
+/sbin/iptables-X
+/sbin/iptables-t nat -A PREROUTING -i external -p udp --dport 5060 -j LOG --log-prefix 'SIP-BEFORE: '
...........I don't really understand this output:
iptables -L -n -v -t nat | grep SIP
2 262 LOG udp -- * * 0.0.0.0/00.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'
144K 24M LOG udp -- * * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: '
41816 5117K LOG udp -- external * 0.0.0.0/0
0.0.0.0/0 LOG flags 0 level 4 prefix `SIP-BEFORE: 'Quoted 6 lines
0 0 LOG udp -- external * 0.0.0.0/0 0.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE: ' 0 0 LOG udp -- external * 0.0.0.0/00.0.0.0/0 udp dpt:5060 LOG flags 0 level 4 prefix `SIP-BEFORE:
'Quoted 6 lines
...
It looks like your nat table isn't getting flushed.
Have you tried running 'iptables -t nat -F' before firewall-masq or adding that to the start of the script?
Quoted 7 lines
Yeah,
I think that you really need flush the NAT table before.
In this case you can see that the second and third rules in you NAT table are logging every UDP packet (you can see that by first and second columns: packets/bytes).Regards,
Wow. That worked.
I always thought iptables -F flushed all the tables. Is there a command that does flush all the tables? Cleans the slate completely?
sean
Quoted 5 lines · Sean darcy
Wow. That worked.
I always thought iptables -F flushed all the tables. Is there a command that does flush all the tables? Cleans the slate completely?
The 'filter' table is the default if no -t argument is specified, so only the filter table gets flushed with iptables -F.
The closest thing I can imagine to a clean slate is flushing all the built-in tables by name, restoring the default policy for each table to ACCEPT, and running iptables -X to delete all user-generated tables:
iptables -t nat -F
iptables -t nat -P ACCEPT
iptables -t raw -F
iptables -t raw -P ACCEPT
iptables -t mangle -F
iptables -t mangle -P ACCEPT
iptables -t filter -F
iptables -t filter -P ACCEPT
iptables -X
'-t filter' is redundant as it's the default but I showed it here for clarity.
Maybe there's an argument that's shorthand for some or all of this, but I'm not aware of one.
Quoted 5 lines · sean darcy
Wow. That worked.
I always thought iptables -F flushed all the tables. Is there a command that does flush all the tables? Cleans the slate completely?
iptables-restore. It's even faster in applying rules and almost always preferrable to raw iptables commands.