I have a DNAT rule on a host who's purpose is to redirect traffic that
is destined for port 23768 to port 5060 on that host:
Chain PREROUTING (policy ACCEPT 7340K packets, 362M bytes)
pkts bytes target prot opt in out source destination
9 3878 DNAT udp -- enp1s7 * 0.0.0.0/0 0.0.0.0/0 udp dpt:23768 to::5060
That rule seems to be working for one host but not another. This is
what I end up with in the conntrack table:
udp 17 29 src=10.75.22.8 dst=10.75.23.212 sport=5060 dport=6060 [UNREPLIED] src=10.75.23.212 dst=10.75.22.8 sport=6060 dport=5060 mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1
udp 17 175 src=10.75.22.200 dst=10.75.22.8 sport=6060 dport=23768 src=10.75.22.8 dst=10.75.22.200 sport=5060 dport=6060 [ASSURED] mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1
udp 17 29 src=10.75.23.212 dst=10.75.22.8 sport=6060 dport=23768 [UNREPLIED] src=10.75.22.8 dst=10.75.23.212 sport=5060 dport=1024 mark=0 secctx=system_u:object_r:unlabeled_t:s0 use=1
So as you can see, 10.75.22.200 seems to be properly natted and moves
to the ASSURED state but the natting for 10.75.23.212 seems to get
confused and we end up with two of UNREPLIED entries.
Any idea what I'm doing wrong, or what is going wrong?
Cheers,
b.
Attachment:
signature.asc
Description: This is a digitally signed message part
