Because of reasons I can't go into here, I found myself having to duplicate a UDP packet stream (netflow data, if it matters) to a second destination.

After some research, I discovered that the TEE target of iptables' mangle table did precisely that:

iptables -t mangle -A PREROUTING -d --protocol udp --destination-port 6343 -j TEE --gateway 
iptables -t mangle -A PREROUTING -d --protocol udp --destination-port 6344 -j TEE --gateway 

The only problem I have now is that the destination server at receives the packets with a destination header of the original address and therefore the software listening for the netflow traffic doesn't accept them.

The "obvious" solution would be to use iptables' own packet rewriting code to rewrite the destination header to the correct value, but that needs to only happen to the duplicated packets and not the originals. Which means my usual go-to of DNAT is out because that's only valid for the PREROUTING table, at which point I can't yet make a distinction between the normal and duplicated packets.

Unless there's something obvious I'm missing, I'm kind of stuck. Any suggestions?

Is there a way to add a rule for POSTROUTING that will change the IP-address of the packet to the correct destination server?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.