5

Because of reasons I can't go into here, I found myself having to duplicate a UDP packet stream (netflow data, if it matters) to a second destination.

After some research, I discovered that the TEE target of iptables' mangle table did precisely that:

iptables -t mangle -A PREROUTING -d 192.168.81.21 --protocol udp --destination-port 6343 -j TEE --gateway 192.168.228.2 
iptables -t mangle -A PREROUTING -d 192.168.81.21 --protocol udp --destination-port 6344 -j TEE --gateway 192.168.228.2 

The only problem I have now is that the destination server at 192.168.228.2 receives the packets with a destination header of the original 192.168.81.21 address and therefore the software listening for the netflow traffic doesn't accept them.

The "obvious" solution would be to use iptables' own packet rewriting code to rewrite the destination header to the correct value, but that needs to only happen to the duplicated packets and not the originals. Which means my usual go-to of DNAT is out because that's only valid for the PREROUTING table, at which point I can't yet make a distinction between the normal and duplicated packets.

Unless there's something obvious I'm missing, I'm kind of stuck. Any suggestions?

Is there a way to add a rule for POSTROUTING that will change the IP-address of the packet to the correct destination server?

2
  • Did you ever figure this out?
    – Jayaram
    Commented Nov 12, 2019 at 10:22
  • @kannaj Sadly, no. I eventually gave up and tried a different workaround for my specific use case. Commented Nov 12, 2019 at 10:23

1 Answer 1

1

I solved this by adding the below iptable rule to the machine where the cloned packet is sent to:

sudo iptables -t nat -A PREROUTING -p udp --dport 9003 -j NETMAP --to xx.xx.xxx.xx

What this does, is it changes the destination IP of any UDP packet destined to port 9003 to the private IP address.

1
  • That sounds like it might work. Unfortunately, I'm no longer in a position to test it because that setup has been torn down in favour of something else, but have a +1 anyway. Commented Jan 10, 2020 at 9:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .