[tproxy] TPROXY with UDP on random ports

[Thomas Penteker]

Hello,

After consulting various resources wihtout success I hope to find help 
on this mailing-list.

I want to intercept all UDP traffic leaving tap1. And possibly reply to 
e.g. DNS-requests. To accomplish this I wrote some python code listening 
to localhost and use iptables with a rule-set like this:

Chain PREROUTING (policy ACCEPT 2 packets, 333 bytes)
  pkts bytes target     prot opt in     out     source               
destination

     0     0 DIVERT     udp  --  tap1   any     anywhere             
anywhere             socket
     0     0 TPROXY     udp  --  tap1   any     anywhere             
anywhere             TPROXY redirect 127.0.0.1:5001 mark 0x1/0x1


Chain DIVERT (1 references)
  pkts bytes target     prot opt in     out     source               
destination
     0     0 MARK       udp  --  any    any     anywhere             
anywhere             MARK set 0x1
     0     0 ACCEPT     udp  --  any    any     anywhere             
anywhere
Policy routing is done with:

ip rule add fwmark 1 lookup 100
ip route add local 0.0.0.0/0 dev lo table 100
This setup was adapted from the kernel's 
Documentation/networking/tproxy.txt. This works flawlessly for a TCP 
socket opened with the IP_TRANSPARENT option.

Unfortunately UDP sockets don't seem to be able to handle connections. 
For example if I do a ncat -u localhost 1234 the socket will receive 
data but cannot send anything back. Wireshark will show exactly three 
packets for:

the incoming ncat packet (to localhost:1234)
the outgoing packet of my software (to :5001)
an ICMP Port unreachable (of course)
For arbitrary ports to work I guess it's not feasable to set up proper 
(S)NATting rules.

So, what's the necessary setup to make this work for arbitrary incoming 
ports?

Thanks for your help

with kind regards,

  Thomas Penteker