0

Here's a picture of my network

I am trying to mirror all packets sent or received by Device B and send them to Device A for logging. I have an OpenWRT acting as a wireless access point, and I have issued the following commands to the OpenWRT router via ssh:

iptables -A PREROUTING -t mangle -d 192.168.1.252 -j TEE --gateway 192.168.1.251
iptables -A POSTROUTING -t mangle -s 192.168.1.252 -j TEE --gateway 192.168.1.251

When I run iptables --list -t mangle I get the following:

root@OpenWrt:~# iptables --list -t mangle
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination
fwmark     all  --  anywhere             anywhere
TEE        all  --  anywhere             192.168.1.252        TEE gw:192.168.1.251

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
mssfix     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
TEE        all  --  192.168.1.252        anywhere             TEE gw:192.168.1.251

Chain fwmark (1 references)
target     prot opt source               destination

Chain mssfix (1 references)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere             tcp flags:SYN,RST/SYN /* wan (mtu_fix) */ TCPMSS clamp to PMTU

I have opened Wireshark on Device A in promiscuous mode, BUT when I do things on Device B (like connecting to neverssl.com in my browser, or pinging google.com, I don't see the traffic on Device A. What am I doing wrong?

(Note1: If it makes any difference, I have also tried connecting Device A to the OpenWRT router wirelessly, to no avail.)

(Note2: There ARE other devices connected to the Netgear Router, but nothing else connected to the OpenWRT router.)

  • (Apologies if this is the wrong place for this- I was directed here or Unix/Linux by Networking Stack exchange) – Ian Riley Jan 5 '18 at 1:54
  • try -t nat instead of mangle see if that helps. – cybernard Jan 5 '18 at 2:35
  • Just tried -t nat instead of -t mangle (after a fresh reboot), and tried -t nat and -t mangle (as consecutive commands), still didn't work – Ian Riley Jan 5 '18 at 2:58
  • I have cat'd /proc/sys/net/ipv4/ip_forward, and got 1, as expected – Ian Riley Jan 5 '18 at 3:01
  • I'm trying to get a better understanding of pre-routing and post-routing; I think I might have to switch my -s and my -d? Because I want packets which appear to be from .252 BEFORE it goes to the router, and packets that are destined for .252 AFTER routing? – Ian Riley Jan 5 '18 at 3:58

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.