Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to intercept all UDP traffic leaving tap1. And possibly reply to e.g. DNS-requests. To accomplish this I wrote some python code listening to localhost and use iptables with a rule-set like this:

Chain PREROUTING (policy ACCEPT 2 packets, 333 bytes)
 pkts bytes target     prot opt in     out     source               destination   

    0     0 DIVERT     udp  --  tap1   any     anywhere             anywhere             socket
    0     0 TPROXY     udp  --  tap1   any     anywhere             anywhere             TPROXY redirect mark 0x1/0x1

Chain DIVERT (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MARK       udp  --  any    any     anywhere             anywhere             MARK set 0x1
    0     0 ACCEPT     udp  --  any    any     anywhere             anywhere

Policy routing is done with:

ip rule add fwmark 1 lookup 100
ip route add local dev lo table 100

This setup was adapted from the kernel's Documentation/networking/tproxy.txt. This works flawlessly for a TCP socket opened with the IP_TRANSPARENT option.

Unfortunately UDP sockets don't seem to be able to handle connections. For example if I do a ncat -u localhost 1234 the socket will receive data but cannot send anything back. Wireshark will show exactly three packets for:

  1. the incoming ncat packet (to localhost:1234)
  2. the outgoing packet of my software (to :5001)
  3. an ICMP Port unreachable (of course)

For arbitrary ports to work I guess it's not feasable to set up proper (S)NATting rules.

So, what's the necessary setup to make this work for arbitrary incoming ports?

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.