Linux – How to Tee UDP Packets onto a Different Host Using CentOS and IPTables

I had the exact problem and I found that the information from http://comments.gmane.org/gmane.network.dns.unbound.user/1891 solved the problem for me:

Your trace shows that unbound thinks the connection drops MTU 1500+ packets. Faa.gov uses large keys and has a lot of answers above 1480 - i.e. DNSKEY, NXDOMAIN answers. Thus your trouble likely stems from fragmentation issues. Your server cannot receive UDP DNS responses that are larger than 1480 or so.

A simple dig @..faaserver faa.gov DNSKEY +dnssec from the server shows the timeout it produces, likely.

The best solution is to fix the path that is dropping UDP fragments. Fix your firewall, upgrade it, change cisco router rules on old equipment. It must be close to your end, because I can get the fragments just fine. This is the best fix, because it allows your server to run better with large responses, and generally cleans up your network.

The workaround is edns-buffer-size: 1280 in unbound.conf.

A code fix, is in svn trunk development version of unbound. That version should fallback to smaller edns size automatically for you.

And there are useful MTU size test sites out there too.

The ROUTE target from patch-o-matic should compile against your kernel and for the 1.2.7 version of iptables and has a --tee target option which should do what you want. This being said, iptables 1.2.7 is over 11 (!!) years old now, probably so is your kernel version. You really should consider using a more recent piece of code - a lot has changed in the meantime.

There also is the libpcap-based port-mirroring project originally started for the uClibc-backed OpenWRT. It might compile against your platform as well.

Another possible option is the mirred action to tc - but given the date of your codebase I doubt that it would be included out-of-the box, so it would be compiling Kernel modules again.