I have an OpenWrt router (v18.06.5, r7897-9d401013fc), that does a standard (out of the box) NAT between a
192.168.0.1/24 LAN (on
eth1) and one public IP
eth2). The router has the
iptables-mod-tee module loaded and running.
My goal is to monitor the traffic going OUT of the interface
eth2 to the WAN. The monitoring is to be done by a computer running "Wireshark", which is located on the LAN (at
For example when I
ping 188.8.131.52 from another computer on the LAN (e.g. from
192.168.0.2), I expect to see an IP/ICMP Echo request, that has
184.108.40.206 going out on the
eth2 interface to the WAN.
I am using the following command to modify the iptables to send the cloned packets to the host running the "Wireshark":
iptables -t mangle -A POSTROUTING -o eth2 -j TEE --gateway 192.168.0.3
It works but "Wireshark" displays the IP/ICMP Echo request with
220.127.116.11...which is wrong, because the
ip.src looks like it would be before it is SNAT'ed (or Masqueraded) !!!
ip.src should be
18.104.22.168 which is the IP of my public WAN interface... because if it wasn't, then the
22.214.171.124 host would not know where to send the ICMP Echo reply to, however the ping command is getting ICMP Echo replies from the
126.96.36.199 host (as it should).
Why is this happening and how to correct it ?