0

enter image description here

I have an OpenWrt router (v18.06.5, r7897-9d401013fc), that does a standard (out of the box) NAT between a 192.168.0.1/24 LAN (on eth1) and one public IP 140.82.118.4 (on eth2). The router has the iptables-mod-tee module loaded and running.

My goal is to monitor the traffic going OUT of the interface eth2 to the WAN. The monitoring is to be done by a computer running "Wireshark", which is located on the LAN (at 192.168.0.3).

For example when I ping 8.8.8.8 from another computer on the LAN (e.g. from 192.168.0.2), I expect to see an IP/ICMP Echo request, that has ip.src == 140.82.118.4 and ip.dst == 8.8.8.8 going out on the eth2 interface to the WAN.

I am using the following command to modify the iptables to send the cloned packets to the host running the "Wireshark":
iptables -t mangle -A POSTROUTING -o eth2 -j TEE --gateway 192.168.0.3

It works but "Wireshark" displays the IP/ICMP Echo request with ip.src == 192.168.0.2 and ip.dst == 8.8.8.8...which is wrong, because the ip.src looks like it would be before it is SNAT'ed (or Masqueraded) !!!

The ip.src should be 140.82.118.4 which is the IP of my public WAN interface... because if it wasn't, then the 8.8.8.8 host would not know where to send the ICMP Echo reply to, however the ping command is getting ICMP Echo replies from the 8.8.8.8 host (as it should).

Why is this happening and how to correct it ?

2

1 Answer 1

0

The rule in mangle's POSTROUTING is ran early than rule in nat's POSTROUTING...so Source NAT is not happened when you do TEE operation in mangle's POSTROUTING .... see below attached iptables diagram: https://th.bing.com/th/id/R.aa2afe9a3c09b762af0b59c8670c7740?rik=SvxGxvrwso1veg&riu=http%3a%2f%2flinux-ip.net%2fnf%2fnfk-traversal.png&ehk=kT6op7%2bDt4yCPX1npGPAw9mWOpRiFTZsA5qJ0HMDQZo%3d&risl=&pid=ImgRaw&r=0

iptables diagram

1
  • Your informational post offers no solution. This site is for solutions, but you have just pointed them to information. OP is asking Why and how to fix. Please revise your answer.
    – number9
    Commented May 25, 2022 at 13:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .