Further to Caleb's answer, if you are working with newer
iptables (v1.4.14) that no longer has the
ROUTE target you will need something like the following, tested on Debian Wheezy*:
iptables -A PREROUTING -t mangle -p tcp ! -s 127.0.0.1 --dport 8001 -j TEE --gateway 127.0.0.1
iptables -A OUTPUT -t nat -p tcp -s 127.0.0.1/32 --dport 8001 -j DNAT --to 127.0.0.1:8002
Test using "netcat" (
man nc). In a terminal window type to following and press the
nc -l 8002
The command will wait for input that you will type in a second terminal window.
In s second terminal window type the following and press the
nc 127.0.0.1 8001
The command will wait for further input. Type anything and press the
Enter key. After you press the
Enter key in the second terminal window, the text that you typed in the second terminal window should appear in the first terminal window. Press
Ctrl-c in the second window to end the session.
*This syntax is not supported in RHEL/Centos (6.5 or earlier) :-( so you need to use
socat to tee and forward incoming packets on the original port to two new ports. If you had processes listening on the original receiving port then you need to reconfigure them to listen on one of the tee'd ports as
socat is now the listener on the original port. See this SE post for example
socat syntax for port cloning.