You can use my tun2socks program for the "TCP catching" part. This program makes a virtual TUN network interface that forwards all outgoing TCP connections through a SOCKS proxy. If you add a routing rule (ip rule) to forward Ipad's connection into tun2socks' TUN interface, tun2socks will forward it to your SOCKS5 proxy. It should be much easier to perform the MITM attack in/as a SOCKS proxy.
Note that this approach is similar to the iptables redirect rule from your point of view, but you don't have to do anything special to figure out the real destination of the connection - it will be present in the SOCKS5 protocol headers.
UPDATE: getting packets from the Ipad into the TUN interface is in fact harder than it seems. I'm assuming that you router has a
br0 bridge interface which bridges
wlan0 (where the Ipad is) and
eth0 (where the Tivo is). Note that I'm not very familiar with DD-WRT, so the names may be different (check with
Now the problem is that packets from the Ipad (
wlan0) to Tivo (
eth0) are not routed, but bridged (i.e. the same thing that a switch does). This means that even if you add ip rules, they won't matter, because those packets won't go through the router, at least logically speaking. To solve this, you have to redirect the packets from the Ipad as if they were directed directly to the MAC address of
br0 and not to the MAC address of the Tivo, which is at
eth0; this will make the kernel treat them as incoming IP packets, hopefully routing them according to the ip rules and routing table. Finally, the command is:
ebtables -t nat -A PREROUTING -i wlan0 -p ipv4 --ip-source <ip_of_ipad> --ip-destination <ip_of_tivo> --ip-protocol TCP -j dnat --to-destination <mac_of_br0>
This adds an ebtables rule that will redirect matching packets received on
wlan0 directly to
br0. You may have to add more conditions here if this catches too much. Note that
dnat does not mean the usual (IP) NAT - in ebtables, NAT means changing the MAC address of frames, rather than the IP address.
You can get a compiled version of tun2socks for DD-WRT here; hopefully it will work on your device.