4

Were does the packed cloned by iptables-mod-tee go after cloning when I add a rule like this ?:

iptables -t mangle -A POSTROUTING -o eth2 -j TEE --gateway 192.168.0.3

Please refer to the diagram below. I think it is obvious that with the command above, the iptables-mod-tee module uses the POSTROUTING chain of the mangle table as the cloning source but what happens with the packet after it is cloned ? i.e. to which chain and table does the clone go to ?

enter image description here

EDIT: Added a red dashed line to the diagram above, to depict the cloned packet's path described in the answer.

enter image description here

Improve this question
0

1 Answer 1

Reset to default
2

The packet cloned through TEE, is set to be untracked by conntrack, prevented from being duplicated again, and emitted through the local output part of the routing stack, so first seen by raw/OUTPUT (you can also refer to this Packet flow in Netfilter and General Networking schematic: that would be right after the local process). This would be the same if the duplication was done before (eg in mangle or raw PREROUTING) for a routed packet. This makes it difficult (but not impossible) to receive additional treatment like an additional nat, since it won't be tracked and it's difficult to distinguish it from the original.

Here's an example TRACE (using iptables-legacy's version) capture in a setup similar to OP's of a ping made from 192.168.0.2 to 8.8.8.8: the capture was on the router using iptables -t raw -A OUTPUT -j TRACE. The original routed packet will not appear since it would have to be captured from raw/PREROUTING, thus validating the explanation above telling it's done from output.

TRACE: raw:OUTPUT:policy:2 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1 TRACE: mangle:OUTPUT:policy:1 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1 TRACE: mangle:POSTROUTING:policy:2 IN= OUT=eth1 SRC=192.168.0.2 DST=8.8.8.8 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=39209 DF PROTO=ICMP TYPE=8 CODE=0 ID=3070 SEQ=1
Improve this answer
5
  • You wrote that the cloned packet is "emitted through the local output part of the routing stack". Does this mean that the cloned packet's path is as depicted by the red dashed line in the OP's edited diagram ? Commented Nov 24, 2019 at 11:23
  • Note that the source of these cloned packets is the outbound eth2 interface and their destination is the eth1 interface, so a loop should not happen. Commented Nov 24, 2019 at 12:00
  • Thanks, so the dashed red line correctly depicts the cloned packet's path, right? Also, please take a look at this related question: unix.stackexchange.com/questions/553899/… Commented Nov 24, 2019 at 18:25
  • yes (I changed my answer before to reflect this) Commented Nov 24, 2019 at 18:35
  • I added a comment on the other question. But I think this one is done, isn't it? Commented Nov 24, 2019 at 18:37

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.