Iptables port forwarding live rtsp video stream

iptablesrtspvideo

I'm trying to port forward a connection to a rtsp live video feed within my local network. The connection starts over tcp but then (viewing with wireshark) a random udp port is attempted to be established by the video server but they never get to the computer trying to connect. I can view the stream on the host computer running iptables but port forwarding isn't working

For the image reference wireshark screenshot the client trying to connect is part of network 10.100.0.0, the host computer that is running iptables is 192.168.4.222 and the video server is 192.168.4.98 — you can see at the bottom of the picture that video is starting to be sent to the host at port 55072 but it's not getting forwarded to the client

What am I missing in my iptables to get this connection going? here is relevant info from my iptables. eth2 is the network that connects to my computer.

*nat
-A PREROUTING -i eth2 -p tcp -m tcp --dport 12098 -j DNAT --to-destination 192.168.4.98:5554
COMMIT
*filter
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -s 192.168.4.98/32 -j ACCEPT
-A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
-A FORWARD -s 192.168.4.98/32 -j ACCEPT
COMMIT

Best Answer

Try adding a forwarding rule for udp as well

-A PREROUTING -i eth2 -p udp -m udp --dport 12098 -j DNAT --to-destination 192.168.4.98:5554

Related Solutions

Linux – iptables port forward forwarding

You're sending the traffic to 10.52.208.221. Given the config you posted, your problem is the webserver, not the firewall. Your rules look to be correct. FORWARD and INPUT are redirected to RH-Firewall-1-INPUT where your first rule is to allow all traffic. As somebody else pointed out, you could be allowing all traffic on eth1, while the world is actually coming in eth0. Secondary, you have to NAT the traffic as it goes back out to the world

iptables --table nat --append POSTROUTING --proto tcp --dport 80 --jump MASQUERADE -o OUT_INTERFACE

Your traffic originating from the router will never hit the input or forward chains, but instead traverse the output chain on to the webserver. Other systems in that subnet will similarly go directly to the webserver. Systems out on the world at large however will traverse the INPUT / FORWARD chains and need SNAT as well as DNAT so that it appears to the world to be one machine. You still cannot test from within your network. you must test from the opposite interface from the webserver. Get me your IP addresses and I'll point you to the proper configs.

Iptables – ftp tls firewalled :(

In Passive mode, when the client wants to get a file from the server or send a file to the server, the FTP server will pick a random port and send that port to the FTP client.

When you're not using encryption, a properly configured firewall (using the ip_conntrack_ftp helper kernel module, which may be what you're missing for non-TLS connections) would "listen in" on the connection and mark these connections as RELATED. With encryption the firewall can't listen in.

The quick and dirty solution to this is to configure the FTP server to choose a small range of ports for passive connections, and then allow access to all of these ports. For instance, in vsftpd:

pasv_min_port=12000
pasv_max_port=12049

Then in iptables:

iptables -A INPUT -p tcp -m tcp -i eth0 --dport 12000:12049 -j ACCEPT

Allowing anyone to access these ports opens one possible exploit: if someone were to be scanning them over and over they might get lucky and be able to "beat" the real user to the data port and grab the file. Ideally your FTP server would check and make sure the connection is coming from the same place as the original connection, but thanks to things like "FXP" (transferring files from one server to another server by convincing one to make an active connection to the other's passive data port) some servers don't check the connection by default. You should check your configuration file and see if there is an option to disable FXP, and use it. (vsftpd calls this "promiscuous" and is disabled by default.)

Related Topic