[SOLVED] IP catch-all?

mwjones · 03-12-2010, 10:59 AM

Long time reader, first-time poster.

I'm setting up a malware analysis lab, and want to have all network traffic redirect to a Linux box. The DNS part of it has been figured out with bind9. But I'm having trouble figuring out how to route all IP traffic.

For example, if my Linux box is 10.1.1.1, and a system wants to communicate to 1.2.2.3, how do I make it believe 1.2.2.3 and 10.1.1.1 are the same? My initial guesses were iptables or maybe the route or ip commands, but thus far I have not been able to figure it out.

Many TIA!

acid_kewpie · 03-12-2010, 03:50 PM

You should be able to just use the redirect module, just like it's often used for a transparent proxy.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 100:200 -j REDIRECT --to-ports 100-200

mwjones · 03-17-2010, 08:58 AM

Quote:

Originally Posted by acid_kewpie

You should be able to just use the redirect module, just like it's often used for a transparent proxy.

iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 100:200 -j REDIRECT --to-ports 100-200

Thanks! I actually found a smaller rule caught everything for me, including UDP, ICMP, etc.

Code:

iptables -t nat -A PREROUTING -i eth1 -j REDIRECT

Exactly what I needed. Thanks again!