Configured SNAT with static ports
rule 10 {
outbound-interface eth0.4002
protocol tcp_udp
source {
address 10.1.2.2
port 5060
}
translation {
address 92.46.96.96
port 5060But translation looks
show nat s translations
Pre-NAT Post-NAT Prot Timeout 10.1.2.2:5060 92.46.96.96:1024 udp 3598
How to correct configure static port to port SNAT?
I have verified that this is working on 1.1.8 so there might be a configuration or operation issue that is making you see this behavior (I actually have this working in production at scale using over 14,500 rules across 28 chains).
First thing to check:
NAT rules will only take effect on new connections that happen after they're put in place. Did you verify that there wasn't an existing conntrack entry for this translation from before the rule was added?
If you're sure the rule was there beforehand, the other thing to check is that no NAT rules that would match come before it (only the first matching rule will be applied).
If that doesn't seem to be it, then I'd like to verify the actual NAT rules in the kernel. Using a root shell (sudo -i) can you provide the output of:
iptables -L -n -v -t nat
It would also be helpful to see your entire NAT configuration and not just the rule for this translation.
Thank you for your attention, cause it's router in production at night executed
reset conntrack
I don't know what it was but now all works fine, sorry for the trouble.
It was likely the first scenario that I mentioned where there was traffic already established before the NAT rule was created. Also note that a reset conntrack is essentially a flush of the conntrack table and can be disruptive for established connections. Alternatively you could have cleared conntrack entries for the specific host address only as a more safe way of doing it in the future.