Hi,
I have a problem using iptables as a NAT box. I'm testing a p2p VoIP
system trying to establish UDP channels using something like STUN.
------------ snat ------------
------------
| A |-----| X |-----<-->------ | Server S
|---<----->-----| B |
------------(p1) \(P1) ------------
/ (P2) ------------
\------<----->-------<---->-------/
X is iptables with a MASQUERADE (or SNAT) rule
1- A sends a packet to S from port p1
2- X opens port P1 (should be equal to p1)
3- S answers to A with a message containing UDP port of B
4- B knows port P1 of X thanks to S too
=> Sometimes A sends the first packets of the communication to B through
X, then B can send packets to A too. Otherwise B sends the first packets
and X seems to drop them (we can see icmp). Then A sends UDP packets to
B and at this time iptables opens a new port 1024 for instance different
from P1.
It is like the uplet
[(src=(@A,p1),dst=(@B,P2)),(src=(@X,P1),dst=(@B,P2))] wasn't available
anymore and so iptables changes P1 to P1'. Doing this, only one part of
the uplet changes. I thought that conntrack forces the fact that for
(@A,p1),(@B,P2) there is only a unique couple on the other side (= at
the end of iptables treatments).
I used iptables 1.2.7a for that test. Anyone can tell me if a recent
version can solve this problem ?
Thanks.
Olivier GRALL.
