3

Because of reasons I can't go into here, I found myself having to duplicate a UDP packet stream (netflow data, if it matters) to a second destination.

After some research, I discovered that the TEE target of iptables' mangle table did precisely that:

iptables -t mangle -A PREROUTING -d 192.168.81.21 --protocol udp --destination-port 6343 -j TEE --gateway 192.168.228.2 
iptables -t mangle -A PREROUTING -d 192.168.81.21 --protocol udp --destination-port 6344 -j TEE --gateway 192.168.228.2 

The only problem I have now is that the destination server at 192.168.228.2 receives the packets with a destination header of the original 192.168.81.21 address and therefore the software listening for the netflow traffic doesn't accept them.

The "obvious" solution would be to use iptables' own packet rewriting code to rewrite the destination header to the correct value, but that needs to only happen to the duplicated packets and not the originals. Which means my usual go-to of DNAT is out because that's only valid for the PREROUTING table, at which point I can't yet make a distinction between the normal and duplicated packets.

Unless there's something obvious I'm missing, I'm kind of stuck. Any suggestions?

Is there a way to add a rule for POSTROUTING that will change the IP-address of the packet to the correct destination server?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.