I configure the iptable output chain DNAT conversion by the following command.
iptables -t nat -A OUTPUT -p tcp --dport 5000 -j DNAT --to 10.100.1.10:2048
When I link 10.100.20.4:5000 on the client 10.100.30.5, the traffic is successfully forwarded to 10.100.1.10:2048.
And the client connection addr I received on the server 10.100.1.10 is 10.100.30.5:27929.
Now I want to get the DNAT record through 10.100.30.5:27929 on the client by command conntrack. The command is
# conntrack -L -s 10.100.30.5 -r 10.100.1.10 -u ASSURED
tcp 6 431995 ESTABLISHED src=10.100.30.5 dst=10.100.20.4 sport=27929 dport=5000 src=10.100.1.10 dst=10.100.30.5 sport=2048 dport=27929 [ASSURED] mark=0 secmark=0 use=2
tcp 6 431987 ESTABLISHED src=10.100.30.5 dst=10.100.20.5 sport=59717 dport=5000 src=10.100.1.10 dst=10.100.30.5 sport=2048 dport=27929 [ASSURED] mark=0 secmark=0 use=2
There are two records using port 27929 in the return packet record here, but I want to get only one record.
What should i do to avoid port duplication.