UniFi Dream Machine Special Edition (UDM SE): IPTables NAT PREROUTING Not Working for Subnet
In this article, we'll explore a confusing situation that some users may encounter when configuring the UniFi Dream Machine Special Edition (UDM SE) firewall with IPTables. Specifically, we will focus on the NAT PREROUTING rule not working as expected for a subnet.
Background: UniFi Dream Machine Special Edition (UDM SE)
The UniFi Dream Machine Special Edition (UDM SE) is a popular all-in-one network device from Ubiquiti Networks that combines a security gateway, a managed switch, and a Wi-Fi 6 long-range access point. It runs a custom version of Debian Linux and allows users to configure firewall rules using the iptables tool.
IPTables and NAT PREROUTING
IPTables is a powerful firewall tool that allows for flexible configuration of network traffic rules on Linux-based systems. The NAT (Network Address Translation) PREROUTING chain is used to redirect incoming traffic before it is routed to its final destination. This can be useful for implementing features such as port forwarding, load balancing, and VPN connections.
The Problem: NAT PREROUTING Rule Not Working for Subnet
When configuring the UDM SE firewall with IPTables, some users may find that their NAT PREROUTING rules work as expected for individual IP addresses but not for a subnet. This can be especially confusing when the same rule works correctly for individual IPs within that subnet.
Example:
# This rule works for an individual IP
iptables -t nat -A PREROUTING -d 192.168.1.100 -p tcp --dport 80 -j DNAT --to-destination 10.0.0.10:8080
# This rule does not work for a subnet
iptables -t nat -A PREROUTING -d 192.168.1.0/24 -p tcp --dport 80 -j DNAT --to-destination 10.0.0.10:8080
Solution: Correct Subnet Mask and Order of Evaluation
The issue in the above example is due to the incorrect subnet mask and order of evaluation. When specifying the destination network in the PREROUTING chain, it is essential to use the correct subnet mask to match the desired subnet correctly. Additionally, the order of evaluation of firewall rules is crucial for ensuring that the correct rules are applied.
Correcting the Subnet Mask:
In the above example, the subnet mask should be corrected to 255.255.255.0, which is the correct subnet mask for the 192.168.1.0/24 subnet:
# Corrected subnet mask
iptables -t nat -A PREROUTING -d 192.168.1.0/24 -p tcp --dport 80 -j DNAT --to-destination 10.0.0.10:8080
Correcting the Order of Evaluation:
Firewall rules are evaluated in the order they are defined. It is crucial to ensure that more specific rules are defined before general rules. In the above example, if there is an individual IP rule for a specific IP within the subnet, it should be defined before the subnet rule. This ensures that the specific IP rule takes precedence over the more general subnet rule.
Key Takeaways
- Ensure that the correct subnet mask is used when specifying the destination network in the PREROUTING chain.
- Ensure that firewall rules are evaluated in the correct order, with more specific rules defined before general rules.
References
- Ubiquiti Networks - UniFi Dream Machine Special Edition: https://www.ui.com/unifi-dream-machine-se/
- IPTables - Linux Netfilter Project: https://netfilter.org/projects/iptables/
- NAT - Linux Netfilter Project: https://netfilter.org/documentation/HOWTO/NAT-HOWTO.html