How to configure Full Cone NAT with Iptables

Question

I want to find the right iptables commands combination to address the following need:

• NEs are NATed thru the linux box (using iptables) towards the WAN cloud, where the NTP servers are situated.
• In order to achieve redundancy, the NTP Servers are in a load balancing cluster with one virtual IP address (172.30.4.245)
• The problem is that when the NEs request for NTP updates using the 172.30.4.245, the NTP response is received from one of the actual IP addresses (.200, .230 .240).

Example:

The iptables is not allowing this flow, which is normal since the requested vs responding address are not the same (172.30.4.245 vs 172.30.4.230) :

Request : UDP 10.68.2.11:23445 ---> 172.30.4.245:123 (this is Before NAT, of course after NAT the source is 10.23.14.72) Response: UDP 172.30.4.230:123 ---> 10.23.14.72:23445 (Response to the WAN address)

I'm wondering if there is any way to let iptables establish the UDP flow only based on the (s-port/d-port) regardless of the IP addresses, and execute the NAT back to the LAN based on that.

UDP/NTP is just an example, almost all the needed services are setup in the same way (load balancing in Cluster).

Answer 1

netfilter does not support full cone NAT/endpoint independent mappings out of the box. You'll need a 3rd party kernel module for that.

If the client software supports UPnP IGD or PCP for port mapping requests you can also install a upnp/pcp daemon on the router.

Answer 2

Maybe you should look at your load balancer. Replacing a dumb NAT with something more sophisticated like IPVS should do the job.