I have a Linux box with two lan interfaces, where one is connected to an embedded system device via 192.168.232.0/24 and the other one to a PC via 192.168.236.0/24.
I now want to access the embedded system device from the PC. So the linux box should be simply a gateway or bridge. I cannot change the network settings on the embedded system device.
The interfaces are configured like this:
192.168.232.0/24 dev XTH proto kernel scope link src 192.168.232.250
192.168.236.0/24 dev PC proto kernel scope link src 192.168.236.1
The network layout:
Emb.System Linux
--------------- ------------------------- PC
|192.168.232.1| <-> | (XTH) 192.168.232.250 | -----------------
--------------- | (PC) 192.168.236.1 | <-> |192.168.236.100|
------------------------- -----------------
I tried to forward the required UDP ports 5554 and 5555 using the NAT. The request goes from the PC to the correct interface and the answer comes back. So far so good.
The changes to iptables:
iptables -A FORWARD -p udp -d 192.168.232.1 --dport 5554 -j ACCEPT
iptables -A FORWARD -p udp -d 192.168.232.1 --sport 5554 -j ACCEPT
iptables -A FORWARD -p udp -d 192.168.232.1 --dport 5555 -j ACCEPT
iptables -A FORWARD -p udp -d 192.168.232.1 --sport 5555 -j ACCEPT
iptables -A PREROUTING -t nat -p udp -d 192.168.236.1 --dport 5554 -j DNAT --to-destination 192.168.232.1
iptables -A PREROUTING -t nat -p udp -d 192.168.236.1 --dport 5555 -j DNAT --to-destination 192.168.232.1
iptables -A POSTROUTING -t nat -p udp -d 192.168.232.1 --dport 5554 -j SNAT --to-source 192.168.236.1
iptables -A POSTROUTING -t nat -p udp -d 192.168.232.1 --dport 5555 -j SNAT --to-source 192.168.236.1
But there is one problem left. Another request is sent vom PC interface to the subnet broadcast address for detection purpose, which I cannot see on the XTH interface. The broadcast message is not forwarded. If I start the detection process on the linux box directly, the messages look like this:
14.720809 192.168.236.100 192.168.236.1 UDP 54 56757 > 5554
14.723752 192.168.236.1 192.168.236.100 UDP 60 5554 > 56757
16.541751 192.168.236.100 192.168.236.255 UDP 50 49758 > 5555
<<< no response >>>
...
I’ve seen there is possibly a solution with a “–gateway” option, but this is not supported by iptables of my linux box. Also I’ve seen there seems to be a solution with nftables, but it’s not installed on the system and I don’t know if I’m allowed to install this.
So currently I’m stuck.
Is there any advice how to continue? Can my problem be solved by using iptables v1.8.7? Can I solve the problem with nftable?
I would be very grateful for any ideas that could help me solve the problem.