I have a router, running Debian/Linux 4.1, which has:

  • eth0: attached to a LAN, running DHCPd for wired clients.
  • wan0: attached to the internet
  • wan1: attached to the internet

I want UDP traffic from the LAN, to host H, port P, to be duplicated and NATted out through both wan0 and wan1.

e.g. routing a packet from, with the correct destination host/port, should result in two NATted packets - one sent out through wan0 and one through wan1, both with the same destination host and port.

(The requirement is that particular types of UDP traffic must be sent though both interfaces, minimising latency at the cost of bandwidth. The UDP protocol in question is idempotent, and so is happy to receive duplicate packets, NATted from different router addresses.)

How can I do this with kernel 4.1/iptables? (There are already solutions with later kernels and nftables.)

  • Do you need to do this for all destinations or just for a handful? – plugwash Apr 6 '18 at 19:32
  • @plugwash Just a handful. – fadedbee Apr 9 '18 at 10:09

Look into the iptables TEE target. It's mostly designed for replicating traffic to a separate destination for logging or IDS purposes, but it should be able to do what you want just as well. Debian includes the module for it by default, so you shouldn't need any extra software.

  • Yes, I've looked into this, but TEE just duplicates the packets and sends them to an external host. I need the packets to be duplicated but travel though NATting before leaving, and not have their destination rewritten as TEE does. I also need to control which interface the exit from, not just set their source address. – fadedbee Aug 29 '17 at 15:20
  • 2
    Hmm, in that case, you might look into combining TEE with policy routing and some mangling rules. – Austin Hemmelgarn Aug 29 '17 at 17:17

I think you can probablly solve this by using the tee target in conjunction with network namespaces.

  • Put one of the WAN interfaces in it's own network namespace
  • Connect the network namespaces with a VETH pair.
  • In the main network namespace use the TEE target to send a duplicate of the traffic to the secondary network namespace.
  • Masqurade the TEEd traffic in the second network namespace.

It is not clear to me from the documentation whether TEE changes the destination IP for the second copy or just changes the nexthop. If it does change the destination IP you would have to undo that in the second network namespace.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.