enter image description here

I have an OpenWrt router (v18.06.5, r7897-9d401013fc), that does a standard (out of the box) NAT between a LAN (on eth1) and one public IP (on eth2). The router has the iptables-mod-tee module loaded and running.

My goal is to monitor the traffic going OUT of the interface eth2 to the WAN. The monitoring is to be done by a computer running "Wireshark", which is located on the LAN (at

For example when I ping from another computer on the LAN (e.g. from, I expect to see an IP/ICMP Echo request, that has ip.src == and ip.dst == going out on the eth2 interface to the WAN.

I am using the following command to modify the iptables to send the cloned packets to the host running the "Wireshark":
iptables -t mangle -A POSTROUTING -o eth2 -j TEE --gateway

It works but "Wireshark" displays the IP/ICMP Echo request with ip.src == and ip.dst == is wrong, because the ip.src looks like it would be before it is SNAT'ed (or Masqueraded) !!!

The ip.src should be which is the IP of my public WAN interface... because if it wasn't, then the host would not know where to send the ICMP Echo reply to, however the ping command is getting ICMP Echo replies from the host (as it should).

Why is this happening and how to correct it ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.