Linux – Send all packets going out a specific interface to an nfqueue

iptableslinuxnetworkingUbuntu

In a testing environment, a process sends packets out a specific interface. I want be able to send all the packets going out said interface to an nfqueue. I can do this for incoming packets on the interface by doing something like:

iptables -t mangle -A PREROUTING -i eth0 -j NFQUEUE --queue-num 10

However, attempting to do the same thing on any of the outbound tables gives an error that the -i option is invalid. Is this possible to achieve and if so, how so?

Best Answer

-i is for incoming packets.

Use -o for outgoing packets.

You can find an explanation in the manpage:

   [!] -i, --in-interface name
          Name of an interface via which a packet was received  (only  for
          packets  entering  the  INPUT,  FORWARD  and PREROUTING chains).
          When the "!" argument is used before  the  interface  name,  the
          sense  is  inverted.   If the interface name ends in a "+", then
          any interface which begins with this name will match.   If  this
          option is omitted, any interface name will match.

   [!] -o, --out-interface name
          Name of an interface via which a packet is going to be sent (for
          packets entering the FORWARD, OUTPUT  and  POSTROUTING  chains).
          When  the  "!"  argument  is used before the interface name, the
          sense is inverted.  If the interface name ends in  a  "+",  then
          any  interface  which begins with this name will match.  If this
          option is omitted, any interface name will match.

or in the output of iptables --help:

[!] --out-interface -o output name[+]
                network interface name ([+] for wildcard)

Related Solutions

Linux – Marking packets with iptables with a NAT

I think that you should use the POSTROUTING mangle table since you are marking the packets in the PREROUTING before the NAT engine.

Have a look at the IPTABLE Chain :

IPTABLES CHAIN DRAWING

Iptables Routing – Target to Route Packet to Specific Interface

I've recently hit a similar issue, albeit a slightly different. I wanted to route only TCP port 25 (SMTP) over an OpenVPN tap0 interface, while routing all other traffic (even for the same host) over the default interface.

To do so, I had to mark packets and set up rules for handling it. First, add a rule that make the kernel route packets marked with 2 through table 3 (explained later):

ip rule add fwmark 2 table 3

You could have added a symbolic name to /etc/iproute2/rt_tables, but I did not bother to do so. The number 2 and 3 are randomly chosen. In fact, these can be the same but for clarity I did not do it in this example (although I do it in my own setup).

Add a route for redirecting traffic over a different interface, assuming the gateway being 10.0.0.1:

ip route add default via 10.0.0.1 table 3

Very important! Flush your routing cache, otherwise you will not get a response back and sit with your hands in your hair for some hours:

ip route flush cache

Now, set a firewall rule for marking designated packets:

iptables -t mangle -A OUTPUT -p tcp --dport 465 -j MARK --set-mark 2

The above rule applies only if the packets come from the local machine. See http://inai.de/images/nf-packet-flow.png. Adjust it to your requirements. For instance, if you only want to route outgoing HTTP traffic over the tap0 interface, change 465 to 80.

To prevent the packets sent over tap0 getting your LAN address as source IP, use the following rule to change it to your interface address (assuming 10.0.0.2 as IP address for interface tap0):

iptables -t nat -A POSTROUTING -o tap0 -j SNAT --to-source 10.0.0.2

Finally, relax the reverse path source validation. Some suggest you to set it to 0, but 2 seems a better choice according to https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt. If you skip this, you will receive packets (this can be confirmed using tcpdump -i tap0 -n), but packets do not get accepted. The command to change the setting so packets get accepted:

sysctl -w net.ipv4.conf.tap0.rp_filter=2

Best Answer

Related Solutions

Linux – Marking packets with iptables with a NAT

Iptables Routing – Target to Route Packet to Specific Interface

Related Topic