How to confirm that SNAT and MASQUERADE are using conntrack table to replace the destination IP address of the reply packet

How to confirm that SNAT and MASQUERADE are using conntrack table to replace the destination IP address of the reply packet

http://superuser.com/questions/255705/internal-working-of-rules-in-forward-chain-for-nat

http://conntrack-tools.netfilter.org/conntrack.html

1)
This MASQUERADE target rule performs Source NAT: It replaces the source address of exiting packets from 192.168.1.xxx to your public IP address, while at the same time recording the details of the NAT in the router's conntrack (connection tracking) table.

Because the details of the NAT is recorded, reply packets from the Internet will be checked against that table. If the reply matches a conntrack entry, the packet will experience an 'inverse NAT' (my term), i.e., replacing the destination address (remember, this is a reply!) with the original sender's address (192.168.1.xxx)

2)
Install conntrack
#sudo apt-get install conntrack
http://conntrack-tools.netfilter.org/conntrack.html

3)
Some conntrack commands
a)
Flush conntrack table
#sudo conntrack -F

b)
Dump source NAT connection
#sudo conntrack -L --src-nat

c)
Display a real-time event log
#sudo conntrack -F

d)
List connection tacking table
#sudo conntrack -L

4)
How to see entries in the connection tacking table for the NAT
a)
Add the SNAT target rule
#sudo iptables -t nat -A POSTROUTING -p icmp --dst 173.194.127.147 -j SNAT --to-source 10.0.2.15
OR
Add the MASQUERADE target rule
#sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

b)
ping to the destination IP
#sudo ip netns exec myns1 ping 173.194.127.147

c)
Dump source NAT connection
#sudo conntrack -L --src-nat

5)
How to confirm that, SNAT and MASQUERADE are using conntrack table to replace the destination IP address of the reply packet

a)
ping to the destination IP
#sudo ip netns exec myns1 ping 173.194.127.147

b)
Flush the conntrack table
#sudo conntrack -F
* Run this command continuously

c)
Capture the packet from the interface that come before the Nated interface
#sudo tshark -i veth0 icmp

* Here you can see that reply packets for some request packets are missing.
* See attached sreenshot. There we can't see the reply packets for the request packets 16 and 17.

Howto Network gateway allow and deny packets

Howto gateway allow and deny packets

Gateway interface only allow certain packets to go through it, that is, if the routing table can't find the network which match the destination IP address of the packet.

Example:
* Your gateway interface is veth1

* IP of your gateway interface is 10.1.1.3

* Here the gateway interface veth1 only allow the packets which has destination IP address don't not match/belongs the networks added/defined in the routing table.

* So we need to add SNAT or MASQUERADE rule in the NAT table and change source IP of the packets and get the reply/ACK for the packets we sent.

* When you ping or wget/curl from our namespace "myns1" to different network (eg:ping 173.194.127.147 / www.google.com), the packets will go through the default gateway 10.1.1.3. But we will not get the response/reply back, if the routing table can't find the network for the source IP address of the packets.

http://fosshelp.blogspot.in/2014/07/introduction-to-network-namespace-and.html

iptables example DNAT SNAT and MASQUERADE with network namespace

1)
Create a network namespace and run a simple webserver inside it and make it accessible from global namespace. I am using a VirtualBox Virtual Machine (Ubuntu 14.04) to run this test.

a)
Add a namespace
#sudo ip netns add myns1

b)
List all namespaces
#ip netns list

c)
Execute commands in a namespace
#sudo ip netns exec myns1

d)
Check all the interfaces and their IP in the namespace "myns1"
#sudo ip netns exec myns1 ifconfig -a
#sudo ip netns exec myns1 ip link list

e)
Create veth interface pairs (veth0 and veth1) in global namespace
#ip link add veth0 type veth peer name veth1

f)
List and check veth pairs created in the global namespace
#ip link list
OR
#ifconfig -a

* At this point the interface veth0 and "veth1" don't have any IP,So don't belongs to any network.

g)
If you want to connect the global namespace to the "myns1" namespace, you will need to move one of the veth interfaces to the "myns1" namespace using this command.
#sudo ip link set veth1 netns myns1

h)
Check namespace "myns1", there you can see the moved interface "veth1".
#sudo ip netns exec myns1 ip link
OR
#sudo ip netns exec myns1 ifconfig -a

* At this point the interface "veth1" doesn't have any IP, So doesn't belongs to any network.
* If you run "#ip link list" or "#ifconfig -a" in global namespace, you can't see the "veth1" interface, since it moved to namespace "myns1".

i)
List routing table in the namespace "myns1"
#sudo ip netns exec myns1 route -n
OR
#sudo ip netns exec myns1 ip route list

* At this point, this will be empty.

j)
Assign an IP "10.1.1.2" to "veth1" interface OR Add the interface "veth1" to a network "10.1.1.2/24 or 10.1.1.x".
#sudo ip netns exec myns1 ifconfig veth1 10.1.1.2/24 up

k)
List routing table in the namespace "myns1"
#sudo ip netns exec myns1 route -n
OR
#sudo ip netns exec myns1 ip route list

* At this point you can see the network "10.1.1.2/24 or 10.1.1.x" with interface "veth1" in the routing table.

l)
List routing table in the global namespace
#route -n
OR
#ip route list

* You can see the "veth0" not there in the routing table. So we need to add it.

m)
Assign an IP "10.1.1.3" to "veth0" interface OR Add the interface "veth0" to the same network "10.1.1.2/24 or 10.1.1.x" of "veth1".
#sudo ifconfig veth0 10.1.1.3/24 up

* Note: "veth0" and "veth1" should be in same network "10.1.1.2/24 or 10.1.1.x".

n)
List routing table in the global namespace
#route -n
OR
#ip route list

* At this point you can see the network "10.1.1.2/24 or 10.1.1.x" with interface "veth0" in the routing table.

o)
Test IPs
* Ping to interface "veth0" in the global namespace from global namespace
#ping 10.1.1.3

*Ping to interface "veth1" in the "myns1" namespace from global namespace
#ping 10.1.1.2

* Ping to interface "veth0" in the global namespace from "myns1" namespace
#sudo ip netns exec myns1 ping 10.1.1.3

p)
Run a simple webserver inside the namespace "myns1"
#vim index.html
Hello World
#sudo ip netns exec myns1 netcat -l 80 < index.html

q)
Access webserver running in the namespace "myns1" from global namespace in the Virtual Machine
#wget http://10.1.1.2:80
OR
#curl http://10.1.1.2:80

2)
Add a rule with "DNAT" target in the "PREROUTING" chain of NAT iptables table in the global namespace.

* The DNAT target is used to do Destination Network Address Translation, which means that it is used to rewrite the Destination IP address of a packet. If a packet is matched, and this (DNAT) is the target of the rule, the packet, and all subsequent packets in the same stream will be translated, and then routed on to the correct device, host or network.
http://www.iptables.info/en/iptables-targets-and-jumps.html#DNATTARGET

a)
List all rules in the PREROUTING chain of NAT table
#sudo iptables -t nat -L PREROUTING -nv

b)
Check this before adding the rule with "DNAT" target in the Virtual Machine. curl from your host machine (Ubuntu 13.10).
#curl http://192.168.56.101:8083
curl: (7) Failed to connect to 192.168.56.101 port 8083: Connection refused

c)
Add a rule with port DNAT target to PREROUTING chain of NAT table in the Virtual Machine
#sudo iptables -t nat -A PREROUTING -p tcp -d 192.168.56.101 --dport 8083 -j DNAT --to-destination 10.1.1.2:80
OR
Specify in-interface and remove destination IP
#sudo iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 8083 -j DNAT --to-destination 10.1.1.2:80

* IMP: you should specify destination port with destination IP, like  --to-destination 10.1.1.2:80
* Replace -A with -D to remove this rule
* We can't test ping, since we specified "-p tcp" in the rule. If you want test ping, please remove "-p tcp" from the rule or replace "-p tcp" with "-p icmp".

d)
List all rules in the PREROUTING chain of NAT table
#sudo iptables -t nat -L PREROUTING -nv

e)
Just check this.(Optional)
#sudo netstat -ntlp | grep 80
tcp6       0      0 :::80                   :::*                    LISTEN      2084/apache2

f)
curl from your host machine (Ubuntu 13.10) after adding the rule with DNAT target in the Virtual Machine
#curl http://192.168.56.101:8083

Here curl will not work.
http://www.iptables.info/en/iptables-targets-and-jumps.html#DNATTARGET

f,a)
How to debug.
Goto the Virtual Machine and inspect the "veth1" interface in the namespace "myns1" using tshark and check the SYN packet.
In the output below, you can see that SYN signals are comming to "veth1" interface (10.1.1.2) from 192.168.56.1 (This means DNAT is working), but ACK signals not going back (you can see TCP Retransmission).

#sudo ip netns exec myns1 tshark -i veth1 -f "not port 22"

1   0.000000 192.168.56.1 -> 10.1.1.2     TCP 74 41491 > http [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=40849675 TSecr=0 WS=128
1   2   0.996335 192.168.56.1 -> 10.1.1.2     TCP 74 [TCP Retransmission] 41491 > http [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=40849925 TSecr=0 WS=128
2   3   3.000209 192.168.56.1 -> 10.1.1.2     TCP 74 [TCP Retransmission] 41491 > http [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=40850426 TSecr=0 WS=128
3   4   5.000510 52:14:8c:a0:4f:ea -> 8e:a6:de:48:bf:a2 ARP 42 Who has 10.1.1.2?  Tell 10.1.1.3
4   5   5.000586 8e:a6:de:48:bf:a2 -> 52:14:8c:a0:4f:ea ARP 42 10.1.1.2 is at 8e:a6:de:48:bf:a2

g)
Add a rule with SNAT target in POSTROUTING chain of NAT table in the Virtual Machine
#sudo iptables -t nat -A POSTROUTING -p tcp --dst 10.1.1.2 --dport 80 -j SNAT --to-source 10.1.1.3
OR
Add a rule with MASQUERADE target (for out interface veth0) in POSTROUTING chain of NAT table in the Virtual Machine
#sudo iptables -t nat -A POSTROUTING -p TCP -o veth0 -j MASQUERADE --to-ports 80
*This will auto SNAT the packets going to the interface veth0 or network 10.1.1.x 
http://www.iptables.info/en/iptables-targets-and-jumps.html#MASQUERADETARGET

* Note: Here i am used the match "-p tcp --dst 10.1.1.2 --dport 80", because DNAT in the PREROUTING chain already changed the destination IP and port on the packet.
* Replace -A with -D to remove this rule
* We can't test ping, since we specified "-p tcp" in the rule. If you want test ping, please remove "-p tcp" from the rule or replace "-p tcp" with "-p icmp". 

h)
curl from your host machine (Ubuntu 13.10) after adding the rule with DNAT target in the Virtual Machine
#curl http://192.168.56.101:8083

This will work.
http://www.iptables.info/en/iptables-targets-and-jumps.html#DNATTARGET

h,a)
How to debug.
Goto the Virtual Machine and inspect the "veth1" interface in the namespace "myns1" using tshark and check the SYN packet.
In the output below, you can see that http SYN signals are comming to "veth1" interface (10.1.1.2) from 10.1.1.3 (line-1) and http ACK signal going back from 10.1.1.2 to 10.1.1.3 (line-2) and final http ACK signal from 10.1.1.3 to 10.1.1.2 (line-3). Yoy can also see the HTTP GET request from 10.1.1.3 to 10.1.1.2 (line-5).

#sudo ip netns exec myns1 tshark -i veth1 -f "not port 22"

1   0.000000     10.1.1.3 -> 10.1.1.2     TCP 74 41538 > http [SYN] Seq=0 Win=29200 Len=0 MSS=1460 SACK_PERM=1 TSval=41139563 TSecr=0 WS=128
2   0.000154     10.1.1.2 -> 10.1.1.3     TCP 74 http > 41538 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 SACK_PERM=1 TSval=40860573 TSecr=41139563 WS=128
3   0.000458     10.1.1.3 -> 10.1.1.2     TCP 66 41538 > http [ACK] Seq=1 Ack=1 Win=29312 Len=0 TSval=41139563 TSecr=40860573
4   0.001053     10.1.1.2 -> 10.1.1.3     HTTP 79 Continuation or non-HTTP traffic
5   0.001376     10.1.1.3 -> 10.1.1.2     HTTP 149 GET / HTTP/1.1
6   0.001398     10.1.1.3 -> 10.1.1.2     TCP 66 41538 > http [ACK] Seq=84 Ack=14 Win=29312 Len=0 TSval=41139564 TSecr=40860573
7   0.001548     10.1.1.2 -> 10.1.1.3     TCP 66 http > 41538 [ACK] Seq=14 Ack=84 Win=29056 Len=0 TSval=40860573 TSecr=41139563
8   0.007233     10.1.1.2 -> 10.1.1.3     TCP 66 http > 41538 [FIN, ACK] Seq=14 Ack=84 Win=29056 Len=0 TSval=40860575 TSecr=41139564
9   0.007576     10.1.1.3 -> 10.1.1.2     TCP 66 41538 > http [FIN, ACK] Seq=84 Ack=15 Win=29312 Len=0 TSval=41139565 TSecr=40860575

i)
curl from Virtual Machine or please where we added this iptables rules (firewall machine).

#curl http://192.168.56.101:8083
curl: (7) Failed to connect to 192.168.56.101 port 8083: Connection refused

* This will not work.
http://www.iptables.info/en/iptables-targets-and-jumps.html#DNATTARGET

j)
Add a rule with DNAT target to OUTPUT chain
http://www.iptables.info/en/iptables-targets-and-jumps.html#DNATTARGET

#sudo iptables -t nat -A OUTPUT --dst 192.168.56.101 -p tcp --dport 8083 -j DNAT --to-destination 10.1.1.2:80

* IMP: you should specify destination port with destination IP, like  --to-destination 10.1.1.2:80

* We can't test ping, since we specified "-p tcp" in the rule. If you want test ping, please remove "-p tcp" from the rule or replace "-p tcp" with "-p icmp". 

* Please check the attached figure, you can see that the packets originated from local process/system are passing through OUTPUT and then POSTROUTING chain. So here, for locally generated packets, OUTPUT chain will do DNAT and then POSTROUTING chain will do SNAT.

k)
curl from Virtual Machine or please where we added this iptables rules (firewall machine).

#curl http://192.168.56.101:8083

* This will work.
http://www.iptables.info/en/iptables-targets-and-jumps.html#DNATTARGET

k,a)
How to debug.
Goto the Virtual Machine and inspect the "veth1" interface in the namespace "myns1" using tshark and check the SYN packet.
In the output below, you can see that http SYN signals are comming to "veth1" interface (10.1.1.2) from 10.1.1.3 (line-1) and http ACK signal going back from 10.1.1.2 to 10.1.1.3 (line-2) and final http ACK signal from 10.1.1.3 to 10.1.1.2 (line-3). Yoy can also see the HTTP GET request from 10.1.1.3 to 10.1.1.2 (line-7).

#sudo ip netns exec myns1 tshark -i veth1 -f "not port 22"

1   0.000000     10.1.1.3 -> 10.1.1.2     TCP 74 37848 > http [SYN] Seq=0 Win=43690 Len=0 MSS=65495 SACK_PERM=1 TSval=43099616 TSecr=0 WS=128
2   0.000033     10.1.1.2 -> 10.1.1.3     TCP 74 http > 37848 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 SACK_PERM=1 TSval=43099616 TSecr=43099616 WS=128
3   0.000051     10.1.1.3 -> 10.1.1.2     TCP 66 37848 > http [ACK] Seq=1 Ack=1 Win=43776 Len=0 TSval=43099616 TSecr=43099616
4   0.000131     10.1.1.2 -> 10.1.1.3     HTTP 79 Continuation or non-HTTP traffic
5   0.000144     10.1.1.3 -> 10.1.1.2     TCP 66 37848 > http [ACK] Seq=1 Ack=14 Win=43776 Len=0 TSval=43099616 TSecr=43099616
6   0.000158     10.1.1.2 -> 10.1.1.3     TCP 66 http > 37848 [FIN, ACK] Seq=14 Ack=1 Win=29056 Len=0 TSval=43099616 TSecr=43099616
7   0.000208     10.1.1.3 -> 10.1.1.2     HTTP 149 GET / HTTP/1.1
8   0.000218     10.1.1.2 -> 10.1.1.3     TCP 66 http > 37848 [ACK] Seq=15 Ack=84 Win=29056 Len=0 TSval=43099616 TSecr=43099616
9   0.002479     10.1.1.3 -> 10.1.1.2     TCP 66 37848 > http [FIN, ACK] Seq=84 Ack=15 Win=43776 Len=0 TSval=43099617 TSecr=43099616
10   0.002490     10.1.1.2 -> 10.1.1.3     TCP 66 http > 37848 [ACK] Seq=15 Ack=85 Win=29056 Len=0 TSval=43099617 TSecr=43099617

iptables within OpenStack nova-network

iptables within OpenStack nova-network

http://www.ibm.com/developerworks/cloud/library/cl-openstack-network/

How to Create a Network Namespace and add iptables rules and Test it

1)
Add a namespace
#sudo ip netns add myns1

2)
List all namespaces
#ip netns list

3)
Execute commands in a namespace
#sudo ip netns exec myns1

4)
Check all the interfaces and their IP in the namespace "myns1"
#sudo ip netns exec myns1 ifconfig -a
#sudo ip netns exec myns1 ip link list

5)
The default interface "lo" in the namespace "myns1" doesn't have any IP. So set it like.
#sudo ip netns exec myns1 ifconfig lo 127.0.0.1 up
#sudo ip netns exec myns1 ifconfig -a

6)
List all rules in the PREROUTING chain of NAT table
#sudo ip netns exec myns1 iptables -t nat -L PREROUTING -nv

7)
Add a port redirect rule to PREROUTING chain of NAT table
#sudo ip netns exec myns1 iptables -t nat -A PREROUTING -p tcp --dport 8083 -j REDIRECT --to-ports 8085

* All incoming traffic on port 8083 redirect to port 8085
* http://fosshelp.blogspot.in/2014/07/iptables-port-redirection-example.html

* -t nat ==> Name of the table.
* -A PREROUTING ==> Name of the chain where we need to add the rule.

* -p tcp ==> Name of the Match
* -p tcp --dport 8083 ==> Name of the Match with match options
http://www.iptables.info/en/iptables-matches.html#TCPMATCHES
http://www.iptables.info/en/iptables-matches.html

* -j REDIRECT ==> Name of the Target/Jump
* REDIRECT --to-ports 8085 ==> Name of the Target/Jump with options
http://www.iptables.info/en/iptables-targets-and-jumps.html#REDIRECTTARGET
http://www.iptables.info/en/iptables-targets-and-jumps.html

* We can't test ping, since we specified "-p tcp" in the rule. If you want test ping, please remove "-p tcp" from the rule or replace "-p tcp" with "-p icmp".

8)
List all rules in the PREROUTING chain of NAT table
#sudo ip netns exec myns1 iptables -t nat -L PREROUTING -nv

9)
Listen for an incoming connection/packets to port 8085
#sudo ip netns exec myns1 netcat -l 8085

10)
Send a packet to port 8085 from same machine (127.0.0.1/localhost).
#sudo ip netns exec myns1 telnet 127.0.0.1 8083
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused

* We cannot test our rules from localhost. we shoult use other host or setup REDIRECT rule in OUTPUT chain of NAT table
* http://fosshelp.blogspot.in/2014/07/iptables-port-redirection-example.html

11)
Create veth interface pairs (veth0 and veth1) in global namespace
#ip link add veth0 type veth peer name veth1

Log file
#sudo vim /var/log/kern.log

12)
List and check veth pairs created in the global namespace
#ip link list
OR
#ifconfig -a

* At this point the interface veth0 and "veth1" don't have any IP,So don't belongs to any network.

13)
If you want to connect the global namespace to the "myns1" namespace, you will need to move one of the veth interfaces to the "myns1" namespace using this command.
#sudo ip link set veth1 netns myns1

14)
Check namespace "myns1", there you can see the moved interface "veth1".
#sudo ip netns exec myns1 ip link
OR
#sudo ip netns exec myns1 ifconfig -a

* At this point the interface "veth1" doesn't have any IP, So doesn't belongs to any network.
* If you run "#ip link list" or "#ifconfig -a" in global namespace, you can't see the "veth1" interface, since it moved to namespace "myns1".

15)
List routing table in the namespace "myns1"
#sudo ip netns exec myns1 route -n
OR
#sudo ip netns exec myns1 ip route list

* At this point, this will be empty.

16)
Assign an IP "10.1.1.1" to "veth1" interface OR Add the interface "veth1" to a network "10.1.1.1/24 or 10.1.1.x".
#sudo ip netns exec myns1 ifconfig veth1 10.1.1.1/24 up

17)
List routing table in the namespace "myns1"
#sudo ip netns exec myns1 route -n
OR
#sudo ip netns exec myns1 ip route list

* At this point you can see the network "10.1.1.1/24 or 10.1.1.x" with interface "veth1" in the routing table.

18)
List routing table in the global namespace
#route -n
OR
#ip route list

* You can see the "veth0" not there in the routing table. So we need to add it.

19)
Assign an IP "10.1.1.3" to "veth0" interface OR Add the interface "veth0" to the same network "10.1.1.1/24 or 10.1.1.x" of "veth1".
#sudo ifconfig veth0 10.1.1.3/24 up

* Note: "veth0" and "veth1" should be in same network "10.1.1.1/24 or 10.1.1.x".

20)
List routing table in the global namespace
#route -n
OR
#ip route list

* At this point you can see the network "10.1.1.1/24 or 10.1.1.x" with interface "veth0" in the routing table.

21)
Test IPs
* Ping to interface "veth0" in the global namespace from global namespace
#ping 10.1.1.3

*Ping to interface "veth1" in the "myns1" namespace from global namespace
#ping 10.1.1.1

* Ping to interface "veth0" in the global namespace from "myns1" namespace
#sudo ip netns exec myns1 ping 10.1.1.3

22)
Send request/packets to ports 8083 in the namespace "myns1" from global namespace.
#telnet 10.1.1.1 8083

* Here 10.1.1.1 is the IP of interface "veth1" in the namespace "myns1".
* In namespace "myns1" check the output of command "#sudo ip netns exec myns1 netcat -l 8085", you can see the packets there.(see Step-9).

iptables port redirection example from localhost 127.0.0.1

0)
Create a Virtual Machine and add following iptables steps there.

1)
List all chains and rules in the NAT table
#sudo iptables -t nat -L -nv

2)
List all rules in the OUTPUT chain of NAT table
#sudo iptables -t nat -L OUTPUT -nv

3)
Add a port redirect rule to OUTPUT chain of NAT table
#sudo iptables -t nat -A OUTPUT -p tcp --dport 8083 -j REDIRECT --to-ports 8085

* All incoming traffic on port 8083 redirect to port 8085
* To test our rules from localhost. we shoult use OUTPUT chain of NAT table
* http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg
* OUTPUT chain – NAT for locally generated packets on the firewall.
* http://www.thegeekstuff.com/2011/01/iptables-fundamentals/

* -t nat ==> Name of the table.
* -A OUTPUT ==> Name of the chain where we need to add the rule.

* -p tcp ==> Name of the Match
* -p tcp --dport 8083 ==> Name of the Match with match options
http://www.iptables.info/en/iptables-matches.html#TCPMATCHES
http://www.iptables.info/en/iptables-matches.html

* -j REDIRECT ==> Name of the target
* REDIRECT --to-ports 8085 ==> Name of the target/jump with options
http://www.iptables.info/en/iptables-targets-and-jumps.html#REDIRECTTARGET
http://www.iptables.info/en/iptables-targets-and-jumps.html

4)
Listen for an incoming connection/packet to port 8085
#netcat -l 8085

5)
Send a packet to port 8085 from same machine (127.0.0.1/localhost).
#telnet 127.0.0.1 8083

* This should work and you will get the messages send via telnet,  to port 8083 of virtual machine, in port 8085 of virtual machine.

6)
Delete rule
#sudo iptables -t nat -D OUTPUT -p tcp --dport 8083 -j REDIRECT --to-ports 8085

7)
List all rules in the OUTPUT chain of NAT table
#sudo iptables -t nat -L OUTPUT -nv

 

iptables port redirection example with REDIRECT target and test the rule

iptables REDIRECT target example with rule testing

0)
Create a Virtual Machine and add following iptables steps there.

1)
List all chains and rules in the NAT table
#sudo iptables -t nat -L -nv

2)
List all rules in the PREROUTING chain of NAT table
#sudo iptables -t nat -L PREROUTING -nv

3)
Add a port redirect rule to PREROUTING chain of NAT table
#sudo iptables -t nat -A PREROUTING -p tcp --dport 8083 -j REDIRECT --to-ports 8085

* All incoming traffic on port 8083 redirect to port 8085

* -t nat ==> Name of the table.
* -A PREROUTING ==> Name of the chain where we need to add the rule.

* -p tcp ==> Name of the Match
* -p tcp --dport 8083 ==> Name of the Match with match options
http://www.iptables.info/en/iptables-matches.html#TCPMATCHES
http://www.iptables.info/en/iptables-matches.html

* -j REDIRECT ==> Name of the Target/Jump
* REDIRECT --to-ports 8085 ==> Name of the Target/Jump with options
http://www.iptables.info/en/iptables-targets-and-jumps.html#REDIRECTTARGET
http://www.iptables.info/en/iptables-targets-and-jumps.html

* We can't test ping, since we specified "-p tcp" in the rule. If you want test ping, please remove "-p tcp" from the rule or replace "-p tcp" with "-p icmp".

4)
Listen for an incoming connection/packet to port 8085
#netcat -l 8085

5)
Send a packet to port 8085 from same machine (127.0.0.1/localhost).
#telnet 127.0.0.1 8083

* This will not work and you will get error like "telnet: Unable to connect to remote host: Connection refused"
* We cannot test our rules from localhost. we shoult use other host or setup REDIRECT rule in OUTPUT chain of NAT table
* http://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

NAT table
=======
Iptable’s NAT table has the following built-in chains.

http://www.thegeekstuff.com/2011/01/iptables-fundamentals/ 

a)
PREROUTING chain – Alters packets before routing (before reaching routing table, route -n). i.e Packet translation happens immediately after the packet comes to the system (and before routing). This helps to translate the destination ip address of the packets to something that matches the routing on the local server. This is used for DNAT (destination NAT).

b)
POSTROUTING chain – Alters packets after routing (before reaching routing table, route -n). i.e Packet translation happens when the packets are leaving the system. This helps to translate the source ip address of the packets to something that might match the routing on the desintation server. This is used for SNAT (source NAT).

c)   
OUTPUT chain – NAT for locally generated packets on the firewall.<==IMP

6)
Send a packet from different host/machine. I am going to telnet from my host machine to port 8083 of our Virtual Machine where we added this iptable rules.
#telnet 192.168.56.101 8083

* This should work and you will get the messages send via telnet from host,  to port 8083 of virtual machine, in port 8085 of virtual machine.

7)
Delete rule
#sudo iptables -t nat -D PREROUTING -p tcp --dport 8083 -j REDIRECT --to-ports 8085

8)
List all rules in the PREROUTING chain of NAT table
#sudo iptables -t nat -L PREROUTING -nv

OpenStack neutron How to list iptables custom chains of Filter, NAT, Mangle and Raw iptables tables in a network namespace

1)
List all namespaces

#ip netns
qdhcp-7cc88da5-e38b-4a14-a64a-daa931f1d2d2
qrouter-e7189379-ccd9-44f6-804f-820173f30e26

2)
List all custom chains of Filter iptables table in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables -L -t filter

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
neutron-l3-agent-INPUT  all  --  anywhere             anywhere           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
neutron-filter-top  all  --  anywhere             anywhere           
neutron-l3-agent-FORWARD  all  --  anywhere             anywhere           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
neutron-filter-top  all  --  anywhere             anywhere           
neutron-l3-agent-OUTPUT  all  --  anywhere             anywhere           

Chain neutron-filter-top (2 references)
target     prot opt source               destination        
neutron-l3-agent-local  all  --  anywhere             anywhere           

Chain neutron-l3-agent-FORWARD (1 references)
target     prot opt source               destination        

Chain neutron-l3-agent-INPUT (1 references)
target     prot opt source               destination        
ACCEPT     tcp  --  anywhere             localhost            tcp dpt:9697

Chain neutron-l3-agent-OUTPUT (1 references)
target     prot opt source               destination        

Chain neutron-l3-agent-local (1 references)
target     prot opt source               destination

3)
List all custom chains of NAT iptables table in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables -L -t nat

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        
neutron-l3-agent-PREROUTING  all  --  anywhere             anywhere           

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
neutron-l3-agent-OUTPUT  all  --  anywhere             anywhere           

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination        
neutron-l3-agent-POSTROUTING  all  --  anywhere             anywhere           
neutron-postrouting-bottom  all  --  anywhere             anywhere           

Chain neutron-l3-agent-OUTPUT (1 references)
target     prot opt source               destination        

Chain neutron-l3-agent-POSTROUTING (1 references)
target     prot opt source               destination        
ACCEPT     all  --  anywhere             anywhere             ! ctstate DNAT

Chain neutron-l3-agent-PREROUTING (1 references)
target     prot opt source               destination        
REDIRECT   tcp  --  anywhere             169.254.169.254      tcp dpt:http redir ports 9697

Chain neutron-l3-agent-float-snat (1 references)
target     prot opt source               destination        

Chain neutron-l3-agent-snat (1 references)
target     prot opt source               destination        
neutron-l3-agent-float-snat  all  --  anywhere             anywhere           
SNAT       all  --  10.0.0.0/24          anywhere             to:172.24.4.2

Chain neutron-postrouting-bottom (1 references)
target     prot opt source               destination        
neutron-l3-agent-snat  all  --  anywhere             anywhere      

4)
List all custom chains of Mangle iptables table in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables -L -t mangle

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

5)
List all custom chains of Raw iptables table in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables -L -t raw

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

OpenStack Neutron How to list chains and rules of Filter, NAT, Mangle and Raw iptables tables in a network namespace

1)
List all namespaces

#ip netns

qdhcp-7cc88da5-e38b-4a14-a64a-daa931f1d2d2
qrouter-e7189379-ccd9-44f6-804f-820173f30e26

2)
List all iptables chains and rules of Filter, NAT, Mangle and Raw tables in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables-save

# Generated by iptables-save v1.4.21 on Wed Jul 16 17:53:18 2014
*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [8:564]
COMMIT
# Completed on Wed Jul 16 17:53:18 2014
# Generated by iptables-save v1.4.21 on Wed Jul 16 17:53:18 2014
*nat
:PREROUTING ACCEPT [6:681]
:INPUT ACCEPT [2:393]
:OUTPUT ACCEPT [15:970]
:POSTROUTING ACCEPT [8:550]
:neutron-l3-agent-OUTPUT - [0:0]
:neutron-l3-agent-POSTROUTING - [0:0]
:neutron-l3-agent-PREROUTING - [0:0]
:neutron-l3-agent-float-snat - [0:0]
:neutron-l3-agent-snat - [0:0]
:neutron-postrouting-bottom - [0:0]
-A PREROUTING -j neutron-l3-agent-PREROUTING
-A OUTPUT -j neutron-l3-agent-OUTPUT
-A POSTROUTING -j neutron-l3-agent-POSTROUTING
-A POSTROUTING -j neutron-postrouting-bottom
-A neutron-l3-agent-POSTROUTING ! -i qg-77a4ae69-e3 ! -o qg-77a4ae69-e3 -m conntrack ! --ctstate DNAT -j ACCEPT
-A neutron-l3-agent-PREROUTING -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 9697
-A neutron-l3-agent-snat -j neutron-l3-agent-float-snat
-A neutron-l3-agent-snat -s 10.0.0.0/24 -j SNAT --to-source 172.24.4.2
-A neutron-postrouting-bottom -j neutron-l3-agent-snat
COMMIT
# Completed on Wed Jul 16 17:53:18 2014
# Generated by iptables-save v1.4.21 on Wed Jul 16 17:53:18 2014
*mangle
:PREROUTING ACCEPT [311:33164]
:INPUT ACCEPT [64:6090]
:FORWARD ACCEPT [247:27074]
:OUTPUT ACCEPT [86:7130]
:POSTROUTING ACCEPT [333:34204]
COMMIT
# Completed on Wed Jul 16 17:53:18 2014
# Generated by iptables-save v1.4.21 on Wed Jul 16 17:53:18 2014
*filter
:INPUT ACCEPT [29:3778]
:FORWARD ACCEPT [247:27074]
:OUTPUT ACCEPT [86:7130]
:neutron-filter-top - [0:0]
:neutron-l3-agent-FORWARD - [0:0]
:neutron-l3-agent-INPUT - [0:0]
:neutron-l3-agent-OUTPUT - [0:0]
:neutron-l3-agent-local - [0:0]
-A INPUT -j neutron-l3-agent-INPUT
-A FORWARD -j neutron-filter-top
-A FORWARD -j neutron-l3-agent-FORWARD
-A OUTPUT -j neutron-filter-top
-A OUTPUT -j neutron-l3-agent-OUTPUT
-A neutron-filter-top -j neutron-l3-agent-local
-A neutron-l3-agent-INPUT -d 127.0.0.1/32 -p tcp -m tcp --dport 9697 -j ACCEPT
COMMIT
# Completed on Wed Jul 16 17:53:18 2014

3)
List all chains and rules of Filter table in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables -t filter --list

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
neutron-l3-agent-INPUT  all  --  anywhere             anywhere           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
neutron-filter-top  all  --  anywhere             anywhere           
neutron-l3-agent-FORWARD  all  --  anywhere             anywhere           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
neutron-filter-top  all  --  anywhere             anywhere           
neutron-l3-agent-OUTPUT  all  --  anywhere             anywhere           

Chain neutron-filter-top (2 references)
target     prot opt source               destination        
neutron-l3-agent-local  all  --  anywhere             anywhere           

Chain neutron-l3-agent-FORWARD (1 references)
target     prot opt source               destination        

Chain neutron-l3-agent-INPUT (1 references)
target     prot opt source               destination        
ACCEPT     tcp  --  anywhere             localhost            tcp dpt:9697

Chain neutron-l3-agent-OUTPUT (1 references)
target     prot opt source               destination        

Chain neutron-l3-agent-local (1 references)
target     prot opt source               destination

4)
List all chains and rules of NAT table in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables -t nat --list

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        
neutron-l3-agent-PREROUTING  all  --  anywhere             anywhere           

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        
neutron-l3-agent-OUTPUT  all  --  anywhere             anywhere           

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination        
neutron-l3-agent-POSTROUTING  all  --  anywhere             anywhere           
neutron-postrouting-bottom  all  --  anywhere             anywhere           

Chain neutron-l3-agent-OUTPUT (1 references)
target     prot opt source               destination        

Chain neutron-l3-agent-POSTROUTING (1 references)
target     prot opt source               destination        
ACCEPT     all  --  anywhere             anywhere             ! ctstate DNAT

Chain neutron-l3-agent-PREROUTING (1 references)
target     prot opt source               destination        
REDIRECT   tcp  --  anywhere             169.254.169.254      tcp dpt:http redir ports 9697

Chain neutron-l3-agent-float-snat (1 references)
target     prot opt source               destination        

Chain neutron-l3-agent-snat (1 references)
target     prot opt source               destination        
neutron-l3-agent-float-snat  all  --  anywhere             anywhere           
SNAT       all  --  10.0.0.0/24          anywhere             to:172.24.4.2

Chain neutron-postrouting-bottom (1 references)
target     prot opt source               destination        
neutron-l3-agent-snat  all  --  anywhere             anywhere         

5)
List all chains and rules of Mangle table in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables -t mangle --list

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

6)
List all chains and rules of Raw table in a network namespace

#sudo ip netns exec qrouter-e7189379-ccd9-44f6-804f-820173f30e26 iptables -t raw --list

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

What is endpoint or socket

For example a http-Server uses port number 80, SSH uses port 22 and so on. The combination of IP-address and port number is called socket and is unique. Therefore connections are uniquely defined by their endpoints (=sockets), a connection sends data from the clients socket to the server socket and vice versa, for example from the socket with IP 123.123.123.123, port 65432 to the socket with IP 112.112.112.112, Port 80 as it may occur for a browser on 123.123.123.123 that connects to a http-server on 112.112.112.112. Server processes are usually using standardized ports, so called 'well known ports'. A client usually uses a port from the upper port range (larger than 1023).