0

Possible Duplicate:
How to Tee udp packets onto a different host

I'm running some instances in Amazon's Virtual Private Cloud. One instance is inside a VPN only subnet (10.128.1.0/24) connected to a corporate network (172.16.32.0/24). I have no control over anything on the other end of the tunnel. I only control what's going on in the VPC.

There is a physical server that is sending UDP packets through the tunnel at a proxy server I'm trying to setup through iptables. I'm going to have several app servers in different environments that all need to receive these UDP packets (in the 10.128.5.0/24 subnet). My first attempt at setting up iptables was:

iptables -t nat -A PREROUTING -s 172.16.32.0/24 -p udp --dport 1360 -j DNAT --to 10.128.5.10:1360 --to 10.128.5.11:1360

The problem is two fold. First iptables no longer supports multiple --to flags. And secondly, from my understanding it would have round-robin'd the destination but I need the UDP packets to go to both destinations simultaneously.

QUESTION: Given my constraints, how do I receive a UDP packet and send it simultaneously to two different destinations? I would prefer to keep it in iptables if possible.

EDIT (for clarification): I have UDP packets coming into the proxy (server A). I want that packet to be received by two other servers (B & C), and possibly others in the future. Source address of the UDP packets received by B & C is of no concern, and B & C will never need to send any kind of response back. This is strictly one way. Is this possible and if so how?

Improve this question
3
  • Your problem isn't specified in enough detail to answer. Do you mean you want to send two copies of the unmodified packet to two destinations? Or do you mean you want to create two different packets with two different destinations? And, if the latter, what should happen if the destinations reply to those packets?
    – David Schwartz
    Commented Jan 11, 2013 at 22:11
  • @Zoredache I checked that question, and the associated answer. That is basically my question, but the link mentioned in that answer specifically states that "This will not work on recent kernels and is deprecated!"
    – Brandon
    Commented Jan 12, 2013 at 3:08
  • @DavidSchwartz I edited my post so hopefully it makes more sense now.
    – Brandon
    Commented Jan 12, 2013 at 3:15

1 Answer 1

Reset to default
0

If the packet is address to neither target, you'll have to NAT it to the first target, tee it so that it goes on towards that first target, and then NAT it to the second target.

If the packet is already to one of the targets, then just tee it to the target it is addressed to and then NAT it to the other.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .