How to send back TCP packets using iptables

Question

I am trying to demonstrate TCP communication with a Ubuntu 18.04 box (which mocks a QNX setup) that does not have a listener installed. Consider that due to some license issues it might not be possible to load and run a listener program any time soon either. Is it possible to use iptables to accept connection from a client, receive incoming packets and send them back to the client?

If yes, what are the commands? I want to use netcat to demonstrate sending and receiving of messages.

I have tried following command from this link.

echo 1 > /proc/sys/net/ipv4/ip_forward
sysctl -w net.ipv4.conf.ens4.route_localnet=1
sudo iptables -A FORWARD -i ens4 -o ens4 -m state --state RELATED,ESTABLISHED -j ACCEPT

I have also tried below commands from another StackOverflow question.

sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination <IP>:80
sudo iptables -t nat -I OUTPUT -p tcp --dport 80 -j DNAT --to-destination <IP>:80

But netcat exits immediately. Not sure whether it even attempted connection.

netcat <IP> 80

Other ideas than iptables are also welcome.

Answer 1

For simple demos, it might be easier to also forward traffic using ncat, like in the answer here. Basically just use ncat as your listener, then launch another ncat to resend any data back to your client. (Make sure your client is also listening for this data on whatever port you choose)

ncat -l 10.0.0.1 80 --sh-exec "ncat 10.0.0.2 80"

This is good enough to see your own sent traffic, but only works in one direction. If you need to see something with back-and-forth like web traffic, then you probably want something more advanced like the iptables routing you tried.

The dnat in your rules stands for destination network address translation, and they only remap the destination IP for packets. Since your planned source and destination are the same IP, you also need to set up snat rules to remap the source IP address:

iptables -t nat -A PREROUTING  -p tcp --dst $HOST_IP   --dport 8000 -j DNAT --to-destination $CLIENT_IP
iptables -t nat -A POSTROUTING -p tcp --dst $CLIENT_IP --dport 8000 -j SNAT --to-source $HOST_IP 

I found a couple good writeups on this:

• Linux Packet Filtering and iptables DNAT guide
• Some examples of SNAT, DNAT with iptables with comments
• Enabling IP forwarding on the interfaces, also contains iptables steps for configuring as a gateway

---

Example test case on client:

# listen on port 8000 in background
nc -l 8000 > nc.out &
# verify netcat is listening on client
netstat -ln | grep 8000

# send some data to server via netcat, and you should see job finish if server forwarded successfully
echo hello world | nc 10.0.0.1 8000
[1]+  Done                    nc -l 8000 > nc.out

# and you should see your data captured
cat nc.out
hello world

depending on your distro, you might not be able to listen on protected ports like 80 (selinux may block for example). Make sure you've enabled ip forwarding, as it's usually off by default:

# check current status
sysctl net.ipv4.ip_forward