NAT - how external source port is selected

NAT - how external source port is selected

[Daniel]

Hello,

how on a NAT firewall server using iptables or nftables, are the 
external source ports choosen ? I would say range is 1024-65535 but if 
for instance I use port 5060 for SIP this one can not be used as source 
port. Is there a table of at time used ports ?

Also, SNOM phones are systematically using port 2048 as source port of 
the WAN ip. Is there a mechanism to allow such behavior ?

If you know any good documentation about this (without reading source 
code ;)) will also be accepted :)

Thanks for your great job
-- 
Daniel

Re: NAT - how external source port is selected

[Reindl Harald]

Am 18.08.21 um 15:53 schrieb Daniel:
> how on a NAT firewall server using iptables or nftables, are the 
> external source ports choosen?
NAT don't chose any ports at all

Re: NAT - how external source port is selected

[Florian Westphal]

Daniel <tech@tootai.net> wrote:
> how on a NAT firewall server using iptables or nftables, are the external
> source ports choosen ? I would say range is 1024-65535 but if for instance I
> use port 5060 for SIP this one can not be used as source port. Is there a
> table of at time used ports ?

Are you talking about SNAT/MASQUERADE?

It will try to use whatever port is used.  If the source address
replacement results in a collision, it tries to pick a different source
port between 1024 and 65535.

> Also, SNOM phones are systematically using port 2048 as source port of the
> WAN ip. Is there a mechanism to allow such behavior ?

What do you mean? The initiator is free to pick whatever source port they like.

Re: NAT - how external source port is selected

[Daniel]

How is the magic done then ?

Le 18/08/2021 à 16:22, Reindl Harald a écrit :
>
>
> Am 18.08.21 um 15:53 schrieb Daniel:
>> how on a NAT firewall server using iptables or nftables, are the 
>> external source ports choosen?
> NAT don't chose any ports at all

-- 
Daniel Huhardeaux
+33.368460088@tootai.net	      sip:820@sip.tootai.net
+41.445532125@swiss-itech.ch		    tootaiNET

AW: NAT - how external source port is selected

[Thomas Bätzler]

[-- Attachment #1: Type: text/plain, Size: 2026 bytes --]

Hi Daniel,

the port number for outgoing NATted connections is chosen from the emphemeral port number range, which can be read and configured via the /proc/sys/net/ipv4/ip_local_port_range file.

While one probably could use NAT rules to force an outgoing connection to use a particular source port, it would not make sense to do so because that would lead to problems when two hosts on the internal network would try to connect to the same outside service, since the port tuple for both connections would be identical, which means that they would be mapped to the same connection.

I'm guessing that on the system that establishes an outgoing connection, i.e. a SNOM phone, one can chose to use a fixed source port programmatically by setting a port number in the sockaddr_in structure that's passed to the connect() syscall. I'm presuming you'd get a EADDRNOTAVAIL error when that port is already in use. You can probably look this up in Stevens' TCP/IP Illustrated.

HTH,
i.A. Thomas Bätzler
-- 
BRINGE Informationstechnik GmbH
Zur Seeplatte 12
D-76228 Karlsruhe
Germany

Fon: +49 721 94246-0
Fon: +49 171 5438457
Fax: +49 721 94246-66
Web: http://www.bringe.de/

Geschäftsführer: Dipl.-Ing. (FH) Martin Bringe
Ust.Id: DE812936645, HRB 108943 Mannheim

-----Ursprüngliche Nachricht-----
Von: Daniel <tech@tootai.net> 
Gesendet: Mittwoch, 18. August 2021 15:54
An: netfilter@vger.kernel.org
Betreff: NAT - how external source port is selected

Hello,

how on a NAT firewall server using iptables or nftables, are the external source ports choosen ? I would say range is 1024-65535 but if for instance I use port 5060 for SIP this one can not be used as source port. Is there a table of at time used ports ?

Also, SNOM phones are systematically using port 2048 as source port of the WAN ip. Is there a mechanism to allow such behavior ?

If you know any good documentation about this (without reading source code ;)) will also be accepted :)

Thanks for your great job
--
Daniel

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5050 bytes --]

Re: NAT - how external source port is selected

[Daniel]

Le 18/08/2021 à 16:46, Florian Westphal a écrit :
> Daniel <tech@tootai.net> wrote:
>> how on a NAT firewall server using iptables or nftables, are the external
>> source ports choosen ? I would say range is 1024-65535 but if for instance I
>> use port 5060 for SIP this one can not be used as source port. Is there a
>> table of at time used ports ?
> Are you talking about SNAT/MASQUERADE?
Yes
> It will try to use whatever port is used.  If the source address
> replacement results in a collision, it tries to pick a different source
> port between 1024 and 65535.
OK
>> Also, SNOM phones are systematically using port 2048 as source port of the
>> WAN ip. Is there a mechanism to allow such behavior ?
> What do you mean? The initiator is free to pick whatever source port they like.
Well, how he will know that the port is free ?

-- 
Daniel

Re: NAT - how external source port is selected

[Reindl Harald]

Am 18.08.21 um 16:50 schrieb Daniel:
> How is the magic done then ?

which magic?

a tuple is "src-ip:src-port dst-ip:dst-port" and as long there is no 
collision it's 1:1, if there is a collison a random port is used - 
that's what conntrack is for

you don't need to care on a nat router

> Le 18/08/2021 à 16:22, Reindl Harald a écrit :
>>
>>
>> Am 18.08.21 um 15:53 schrieb Daniel:
>>> how on a NAT firewall server using iptables or nftables, are the 
>>> external source ports choosen?
>> NAT don't chose any ports at all

Re: NAT - how external source port is selected

[Daniel]

Le 18/08/2021 à 18:16, Florian Westphal a écrit :

> Daniel <tech@tootai.net> wrote:
>>>> Also, SNOM phones are systematically using port 2048 as source port of the
>>>> WAN ip. Is there a mechanism to allow such behavior ?
>>> What do you mean? The initiator is free to pick whatever source port they like.
>> Well, how he will know that the port is free ?
> bind() fails for listener socket, connect() fails for outgoing (if
> everything is full).
>
> On conntrack machine, connection tracking table gets queried after SNAT
> to see if the new tuple is still unique.
Thanks to all for the explanation.

-- 
Daniel