2

Were does the packed cloned by iptables-mod-tee go after cloning when I add a rule like this ?:

iptables -t mangle -A POSTROUTING -o eth2 -j TEE --gateway 192.168.0.3

Please refer to the diagram below. I think it is obvious that with the command above, the iptables-mod-tee module uses the POSTROUTING chain of the mangle table as the cloning source but what happens with the packet after it is cloned ? i.e. to which chain and table does the clone go to ?

enter image description here

EDIT: Added a red dashed line to the diagram above, to depict the cloned packet's path described in the answer.

enter image description here

0
1

The packet cloned through TEE, is set to be untracked by conntrack, prevented from being duplicated again, and emitted through the local output part of the routing stack, so first seen by raw/OUTPUT (you can also refer to this Packet flow in Netfilter and General Networking schematic: that would be right after the local process). This would be the same if the duplication was done before (eg in mangle or raw PREROUTING) for a routed packet. This makes it difficult (but not impossible) to receive additional treatment like an additional nat, since it won't be tracked and it's difficult to distinguish it from the original.

Here's an example TRACE (using iptables-legacy's version) capture in a setup similar to OP's of a ping made from 192.168.0.2 to 8.8.8.8: the capture was on the router using iptables -t raw -A OUTPUT -j TRACE. The original routed packet will not appear since it would have to be captured from raw/PREROUTING, thus validating the explanation above telling it's done from output.

TRACE: raw:OUTPUT:policy:2 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1 
TRACE: mangle:OUTPUT:policy:1 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1 
TRACE: mangle:POSTROUTING:policy:2 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1
5
  • You wrote that the cloned packet is "emitted through the local output part of the routing stack". Does this mean that the cloned packet's path is as depicted by the red dashed line in the OP's edited diagram ? Nov 24 '19 at 11:23
  • Note that the source of these cloned packets is the outbound eth2 interface and their destination is the eth1 interface, so a loop should not happen. Nov 24 '19 at 12:00
  • Thanks, so the dashed red line correctly depicts the cloned packet's path, right? Also, please take a look at this related question: unix.stackexchange.com/questions/553899/… Nov 24 '19 at 18:25
  • yes (I changed my answer before to reflect this)
    – A.B
    Nov 24 '19 at 18:35
  • I added a comment on the other question. But I think this one is done, isn't it?
    – A.B
    Nov 24 '19 at 18:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.