Linux – rewrite destination IP of TEEed traffic

dnatiptableslinuxport-mirroringtee

Server 1 and Server 2 (Centos 7) both host the same application, which listens on UDP port 1514. Server 1 receives traffic on this port. The goal is for the application on Server 2 to receive a copy of this traffic.

Server 1 uses iptables to duplicate traffic on UDP 1514 and send it to Server 2:

iptables -t mangle -A PREROUTING -i ens160 -p udp –dport 1514 -j TEE –gateway 10.88.72.40 [server 2]

A tcpdump on Server 2 reveals all of the traffic coming in; HOWEVER, the destination IP is still 10.88.72.41, so the listening application does not detect the traffic. Please help me find a solution so that the application on the second server can detect this traffic. On Server 2, I have tried this policy to rewrite the destination IP of the incoming packets:

iptables -t nat -A PREROUTING -p udp -d 10.88.72.41 –dport 1514 -j NETMAP –10.88.72.40

On Server 1 I have tried similar commands to rewrite (or DNAT) the destination IP of the outgoing packets. I have been working on this for days – if you can solve it I will be eternally grateful!

Best Answer

You sire, are a scholar, a gentleman, and a saint! On my second server, I added a virtual loopback device with the IP of the first server, and IT'S ALIVE! Here is how to add a virtual loopback device in Centos 7:

cd /etc/sysconfig/network-scripts
cp ifcfg-lo ifcgf-lo:1
vi ifcfg-lo:1

and put in that file:

DEVICE=lo:1
IPADDR=10.88.72.41
NETMASK=255.255.255.255
NETWORK=10.88.72.41
BROADCAST=10.88.72.41
ONBOOT=yes
NAME=loopback:1
NM_CONTROLLED="no"

then do:

ifup lo:1
ifconfig  # you should see lo:1 in there

On Server 1, add a static arp entry for Server 2:

arp -s <server2 IP> <server 2 MAC>
Related Topic