Because of reasons I can't go into here, I found myself having to duplicate a UDP packet stream (netflow data, if it matters) to a second destination.
After some research, I discovered that the TEE target of
iptables' mangle table did precisely that:
iptables -t mangle -A PREROUTING -d 192.168.81.21 --protocol udp --destination-port 6343 -j TEE --gateway 192.168.228.2 iptables -t mangle -A PREROUTING -d 192.168.81.21 --protocol udp --destination-port 6344 -j TEE --gateway 192.168.228.2
The only problem I have now is that the destination server at
192.168.228.2 receives the packets with a destination header of the original
192.168.81.21 address and therefore the software listening for the netflow traffic doesn't accept them.
The "obvious" solution would be to use
iptables' own packet rewriting code to rewrite the destination header to the correct value, but that needs to only happen to the duplicated packets and not the originals. Which means my usual go-to of DNAT is out because that's only valid for the PREROUTING table, at which point I can't yet make a distinction between the normal and duplicated packets.
Unless there's something obvious I'm missing, I'm kind of stuck. Any suggestions?
Is there a way to add a rule for POSTROUTING that will change the IP-address of the packet to the correct destination server?