I'm looking to do something like this:

enter image description here

Where the "mini router" is helping to control and secure a legacy system that cannot be updated for complex reasons and resides somewhere out "in the wild". We're hoping to retrofit the systems with a cheap, low-power (e.g., 0.5V and < 100 mA). There are several thousands of these SCADA systems sprinkled everywhere. We need to do a white-hat retrofit but about 15%-30% of the environments we cannot get an IP address (no DHCP) for the "mini router" and need to share the Computer/SCADA system IP. I thought we could set up a transparent bridge (the br0 below works as a bridge):

root% ip link add name br0 type bridge
root% ip link set dev br0 up
root% ip link set dev eth0 master br0
root% ip link set dev eth1 master br0
root% ip address add dev br0
root% sysctl -w net.ipv4.conf.all.forwarding=1

And then use ebtables / iptables / iproute2 to route traffic from Server1 destined for Computer so that we could SSL encrypt / decrypt traffic between them and/or "consume" traffic between Server2 and Computer, since it's intended to configure and control the "mini router".

Because I would like it to be a completely transparent bridge, I removed the addresses from eth0 and eth1:

root% ip address flush dev eth0
root% ip address flush dev eth1
root% ip address add dev eth0
root% ip address add dev eth1
root% ip link set dev eth0 up
root% ip link set dev eth1 up
root% ip link set dev eth0 promisc on
root% ip link set dev eth1 promisc on
root% ip link set dev br0 promisc on # Not sure if needed

Unfortunately, I cannot get traffic diverted to/from the service that will handle control messages.

NOTE: I can in fact assign an un-routable address to br0 (e.g., and if Server1 is on the local LAN segment (e.g., on the same switch) the method described below (Attempts Version 1) works; however, the TCP/IP packets have a src or dst of, which are not routable and can't cross routers or LAN boundaries, but the Server1 and the "mini router" don't seem to care. As per above, I can't just get a DHCP on br0 (which also works), because potentially a thousand plus of the "mini routers" will not be able to get a DHCP address.


How might I be able to do this? Below are the things that I have tried.


I have looked for a number of solutions with little luck. For example, "iptables - Target to route packet to specific interface?", suggests that marking packets and using a different routing table might work; however, the examples are not over a bridge. I've spend quite a bit of time culling through the Netfilter documentation and intuitively it looks like I should be able to put Netfilter NAT between br0 and eth1, but again, I don't see how. LAN-to-LAN IPsec or a straight up VPN solution requires persistent connections between end-points which we will not have. The Computer just needs to periodically phone home or receive push information, but does not need a persistent secure connection. Because the Computer/SCADA system also need to communicate with other systems, the mini router should not interfere with any existing traffic between the Computer and LAN/Router.

Attempts Version 1

First I cleared the slate on rules:

root% ip rule flush
root% ip rule add lookup default priority 32767
root% ip rule add lookup main priority 32766

Getting Ethernet frames between Server1 and Computer to "DROP" to the network layer.

root% ebtables -t broute -A BROUTING -p IPv4 \
      --ip-source --ip-destination \
  -j redirect --redirect-target DROP
root% ebtables -t broute -A BROUTING -p IPv4 \
      --ip-source --ip-destination \
  -j redirect --redirect-target DROP

Redirecting the Server1<-->Computer traffic to the br0 address

root% iptables -t nat -A PREROUTING -p tcp \
      -s -d \
  -j DNAT --to-destination
root% iptables -t nat -A POSTROUTING -p tcp \
      -d \
  -j SNAT --to-source
root% iptables -t nat -A POSTROUTING -j MASQUERADE

Adding a route to Server1 through br0

root% ip route add via dev br0

And keep fingers crossed, but it does not work. Tried many different permutations of this.

Attempts Version 2

More recently, I tried a version closer to the one mentioned above with -j MARK for packet routing to no avail:

root% ip rule add fwmark 2 priority 1000 table 3
root% ip route add default via table 3
root% ip route flush cache
root% ip route flush table 3
root% iptables -t mangle -A OUTPUT -p tcp -s -j MARK --set-mark 2
root% iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE
root% ip route add via dev br0 table 3

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.