The Netfilter's extensions man page states that:

MASQUERADE: This target is only valid in the nat table, in the POSTROUTING chain

QUESTION: How to clone the output of the MASQUERADE target with a TEE target ?

If you look at the diagram of netfilter/iptables below, you will notice that nat.POSTROUTING is the last chain to be evaluated before the packet is sent to the outbound interface. There isn't a raw.POSTROUTING chain, ...or is there ?

enter image description here Also see this.

What is the rationale for processing the mangle and nat tables in the same order at the outbound and inbound interface, when the data flows in opposite directions through these interfaces (egress and ingress) ?

  • 1
    afaik you can't do this with iptables. You should try with nftables because you can always change the priority of a chain's hook ( wiki.nftables.org/wiki-nftables/index.php/… ) – A.B Nov 24 '19 at 18:36
  • other method is tc ... mirred egress mirror because it happens after network, right at the interface layer. But something would have to alter the destination mac address for the intended target (which is what TEE is doing on its own with its gateway parameter). – A.B Nov 24 '19 at 18:52
  • @A.B. And what do you think of modifying .priority = NF_IP_PRI_NAT_SRC to .priority = NF_IP_PRI_CONNTRACK in the code below ?: elixir.bootlin.com/linux/v4.14.151/source/net/ipv4/netfilter/… – George Robinson Nov 24 '19 at 21:20
  • tc mirred is too complex for this on 2nd thought (because of the unchanged mac address). There will be nftables – A.B Nov 24 '19 at 21:46
  • about the priority change, 1/ you wouldn't know what unforeseen side effects this would have (perhaps making firewalls fail etc.) 2/ you'd have to maintain for yourself a patched kernel forever : not good. You should invest time into nftables instead. – A.B Nov 24 '19 at 22:16

As far as I know, since it's not possible to have an iptables rule executed after nat/POSTROUTING, which is the last hook provided by iptables, it's not possible to use iptables to capture a packet post-NAT.

But this is possible when using nftables, since the hook priority is user defined. nft's dup statement is a direct replacement for iptables' TEE. It's possible to mix nftables and iptables as long as they're not both doing NAT (the nat ressource is special and can't be shared properly between iptables and nftables). Using iptables-over-nftables's version of iptables will also work (care should be taken when flushing rulesets), and of course using only nft for everything would also work.

Here's a ready made nft ruleset for this on a router with a NATed LAN on eth1 and its WAN side on eth2, to send a copy to in the LAN side. like described in an other question from OP. To be put in some file named forwireshark.nft and to be "loaded" using nft -f forwireshark.nft:

table ip forwireshark {
        chain postnat {
                type filter hook postrouting priority 250; policy accept;
                oif eth2 counter dup to device eth1

What matters here is that the value 250 has been chosen to be higher than iptables' NF_IP_PRI_NAT_SRC (100).

Here's what would typically receive the wireshark host when the ping host does ping -c1 after some inactivity (note the strange ARP request from the "wrong" IP, which might not be accepted by default on some systems):

root@ns-wireshark:~# tcpdump -e -n -s0 -p -i eth0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
21:06:03.074142 82:01:54:27:4d:d7 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has tell, length 28
21:06:03.074301 9a:80:fb:e6:6a:0a > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has tell, length 28
21:06:03.074343 7e:0a:6c:12:00:61 > 9a:80:fb:e6:6a:0a, ethertype ARP (0x0806), length 42: Reply is-at 7e:0a:6c:12:00:61, length 28
21:06:03.074387 9a:80:fb:e6:6a:0a > 7e:0a:6c:12:00:61, ethertype IPv4 (0x0800), length 98: > ICMP echo request, id 1633, seq 1, length 64

I don't know the rationale on the order of mangle/POSTROUTING and nat/POSTROUTING. Anyway this is part of iptables' limitations, because in nftables, apart from the equivalent of mangle/OUTPUT which is a special type route hook for rerouting, all other equivalent usages of mangle are part of type filter: there's not really a separate mangle type anymore. Being able to choose the order of priorities allows to do more.

  • That is a good answer and a decent solution but i will not use it on current OpenWrt because other users want to continue using the LUCI front-end and switching to nftables would break it. I will just patch the single int nat hook priority in the binary and be done with it (since the mangle table is unused). When LUCI2 comes out with support for nftables, I will switch to your solution. BTW: Do you know to what binary file the code below compiles to? elixir.bootlin.com/linux/v4.14.151/source/net/ipv4/netfilter/… I am too lazy to build entire Linux for 1 int. – George Robinson Nov 24 '19 at 22:28
  • No, I'm sure you'll figure it out – A.B Nov 24 '19 at 22:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.