IPSec Port Mirroring – How to Mirror Incoming Traffic on Specific Port to Another IP Using IPSec

ipseciptablesport-forwardingport-mirroringstrongswan

I want to internally publish an SMTP server (IP 10.0.0.10) that is behind a VPN tunnel on my internal server (192.168.0.12) using strongswan. My strongswan is running within a docker container.

For this I want my internal server 192.168.0.12 to listen to its 25 port and to forward the traffic to the tunneled server on the same port 10.0.0.10:25.

So far I tried using iptables, but without success.

net.ipv4.ip_forward is enabled on both the host and the docker container!

my iptables-save on 192.168.0.12 after strongswan is connected to the tunnel: (and yes I can ping the 10.0.0.10 from 192.168.0.12)

# Generated by iptables-save v1.8.4 on Fri Jul 23 09:55:05 2021
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -s 10.0.0.0/16 -d 192.168.0.10/32 -i eth0 -m policy --dir in --pol ipsec --reqid 1 --proto esp -j ACCEPT
-A OUTPUT -s 192.168.0.10/32 -d 10.0.0.0/16 -o eth0 -m policy --dir out --pol ipsec --reqid 1 --proto esp -j ACCEPT
COMMIT
# Completed on Fri Jul 23 09:55:05 2021
# Generated by iptables-save v1.8.4 on Fri Jul 23 09:55:05 2021
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [2:1600]
:POSTROUTING ACCEPT [2:1600]
:DOCKER_OUTPUT - [0:0]
:DOCKER_POSTROUTING - [0:0]
-A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT
-A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING
-A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.11:45165
-A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.11:53306
-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -m tcp --sport 45165 -j SNAT --to-source :53
-A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -m udp --sport 53306 -j SNAT --to-source :53
COMMIT

command ip r output:

default via 192.168.16.1 dev eth0
192.168.16.0/20 dev eth0 proto kernel scope link src 192.168.16.10 # this is a docker internal network for my services
192.168.0.10/30 dev eth1 proto kernel scope link src 192.168.0.12

I tried various commands like these:

iptables -t nat -A PREROUTING -p tcp --dport 25 -j DNAT --to-destination 10.0.0.10:25
iptables -t nat -A POSTROUTING -p tcp -d 10.0.0.10 --dport 25 -j SNAT --to-source 192.168.0.12

but without success.

I cannot provide any info on the ip r of the host nor the iptables-save.

What am I doing wrong?

Best Answer

I solved my issue using traefik.

I installed traefik on the host (192.168.0.12) that has the strongswan tunnel and used a TCP router to forward all traffic to the tunnel.

traefik installation:

wget -O /traefik.tar.gz https://github.com/traefik/traefik/releases/download/v2.4.12/traefik_v2.4.12_linux_amd64.tar.gz \
    && tar -zxvf /traefik.tar.gz \
    && ln -s /traefik /usr/bin/traefik

traefik.yaml:

entryPoints:
  smtp:
    address: ":1025"

accessLog: {}

providers:
  file:
    directory: /traefik-conf/dynamic/
    watch: true

api:
  dashboard: true
  insecure: true

my /traefik-conf/dynamic/dynamic.yaml:

tcp:
  routers:
    smtp-router:
      rule: "HostSNI(`*`)"
      entryPoints:
        - smtp
      service: smtp-service

  services:
    smtp-service:
      loadBalancer:
        servers:
          - address: 10.0.0.10:25

Run traefik (I don't know how to properly run it as a background daemon):

traefik --configfile /traefik-conf/traefik.yml &

Now I can connect to the tunneled smtp server from everywhere inside my network using 192.168.0.12:1025.

I created an example using docker over here on github

Related Topic