Hello!

Using iptables, I am mirroring all traffic on udp port 1514 from a production CentOS server to a dev CentOS server. As such, the dev server receives a copy of all udp 1514 packets sent to the production server. Here is the command I used:

iptables -t mangle -D PREROUTING -i ens160 -p udp --dport 1514 -j TEE --gateway 10.88.72.40

When capturing these packets on the second server, the destination IP is that of the production server. This is a problem because I want a service to interact with this traffic. How do I "trick" the second server into thinking that the mirrored packets are meant for it? Have been looking into rewriting the destination IP of the packets, but no luck so far. Thanks.

You are aware that the above is used to delete the rule.

Yes, that was a typo. I know that rule works because I'm seeing all of the redirected packets running tcdump on the second server. I used this command:

iptables -t mangle -A PREROUTING -i ens160 -p udp --dport 1514 -j TEE --gateway 10.88.72.40

Have your tried this:

Might need to create a new change and do everything in there so it is all grouped together.

Lazydog, would I add your policy to the first server (mirroring the traffic) or the second (receiving packets with wrong destination IP)?

You would need to do this on the host where you have the other rules to send the traffic to the second system.

I would think a new chain would be best. Traffic comes in and then is pushed to the chain where you could change the ip address and then send it off to the second system.

I'm new to iptables. Could you show me a config example of what you're talking about?

On second thought you might be able to do this on the second seerver. The server would see that the packet is for itself and then do what you want it to do.

I have discovered that, on the second machine, I cannot use iptables to route packets addressed to other IPs to localhost. I'm running Centos7, which doesn't support kernel 3.6, which is needed to do this.

So my plan is to add a second interface on the original server. Then:

iptables -t mangle -A PREROUTING -i ens160 -p udp --dport 1514 -j TEE --gateway 10.88.72.43

where 10.88.72.43 is the second NIC of the same server. The problem is that I cannot detect any packets reaching this interface. Please advise on how I can redirect TEE packets to a different interface on the same host.

Have you tried to use PREROUTE on the incoming packet to set the ip address?

If I did that, then the application on the first server wouldn't be able to see the packets.

On the second server.

Yes, on the second server I tried:

iptables -t nat -A PREROUTING -p udp -d 10.88.72.41 --dport 1514 -j NETMAP --10.88.72.40

where 10.88.72.40 is the IP of the second server. In my tcpdump capture on the second server, the destination IP is still 10.88.72.41 .

TCPDUMP is capturing the packet before it has transversed the stack.

I found the answer. On the second server, create a virtual loopback device with the same IP as the first server.