I'm looking to do something like this:
Where the "mini router" is helping to control and secure a legacy system that cannot be updated for complex reasons and resides somewhere out "in the wild". We're hoping to retrofit the systems with a cheap, low-power (e.g., 0.5V and < 100 mA). There are several thousands of these SCADA systems sprinkled everywhere. We need to do a white-hat retrofit but about 15%-30% of the environments we cannot get an IP address (no DHCP) for the "mini router" and need to share the Computer/SCADA system IP. I thought we could set up a transparent bridge (the br0 below works as a bridge):
root% ip link add name br0 type bridge root% ip link set dev br0 up root% ip link set dev eth0 master br0 root% ip link set dev eth1 master br0 root% ip address add 10.253.252.2 dev br0 root% sysctl -w net.ipv4.conf.all.forwarding=1
And then use ebtables / iptables / iproute2 to route traffic from Server1 destined for Computer so that we could SSL encrypt / decrypt traffic between them and/or "consume" traffic between Server2 and Computer, since it's intended to configure and control the "mini router".
Because I would like it to be a completely transparent bridge, I removed the addresses from eth0 and eth1:
root% ip address flush dev eth0 root% ip address flush dev eth1 root% ip address add 0.0.0.0 dev eth0 root% ip address add 0.0.0.0 dev eth1 root% ip link set dev eth0 up root% ip link set dev eth1 up root% ip link set dev eth0 promisc on root% ip link set dev eth1 promisc on root% ip link set dev br0 promisc on # Not sure if needed
Unfortunately, I cannot get traffic diverted to/from the service that will handle control messages.
NOTE: I can in fact assign an un-routable address to br0 (e.g., 169.254.1.2) and if Server1 is on the local LAN segment (e.g., on the same switch) the method described below (Attempts Version 1) works; however, the TCP/IP packets have a src or dst of 169.254.1.2, which are not routable and can't cross routers or LAN boundaries, but the Server1 and the "mini router" don't seem to care. As per above, I can't just get a DHCP on br0 (which also works), because potentially a thousand plus of the "mini routers" will not be able to get a DHCP address.
How might I be able to do this? Below are the things that I have tried.
I have looked for a number of solutions with little luck. For example, "iptables - Target to route packet to specific interface?", suggests that marking packets and using a different routing table might work; however, the examples are not over a bridge. I've spend quite a bit of time culling through the Netfilter documentation and intuitively it looks like I should be able to put Netfilter NAT between br0 and eth1, but again, I don't see how. LAN-to-LAN IPsec or a straight up VPN solution requires persistent connections between end-points which we will not have. The Computer just needs to periodically phone home or receive push information, but does not need a persistent secure connection. Because the Computer/SCADA system also need to communicate with other systems, the mini router should not interfere with any existing traffic between the Computer and LAN/Router.
Attempts Version 1
First I cleared the slate on rules:
root% ip rule flush root% ip rule add lookup default priority 32767 root% ip rule add lookup main priority 32766
Getting Ethernet frames between Server1 and Computer to "DROP" to the network layer.
root% ebtables -t broute -A BROUTING -p IPv4 \ --ip-source 188.8.131.52 --ip-destination 10.0.0.1 \ -j redirect --redirect-target DROP root% ebtables -t broute -A BROUTING -p IPv4 \ --ip-source 10.0.0.1 --ip-destination 184.108.40.206 \ -j redirect --redirect-target DROP
Redirecting the Server1<-->Computer traffic to the br0 address
root% iptables -t nat -A PREROUTING -p tcp \ -s 220.127.116.11 -d 10.0.0.1 \ -j DNAT --to-destination 10.253.252.2 root% iptables -t nat -A POSTROUTING -p tcp \ -d 10.253.252.2 \ -j SNAT --to-source 10.0.0.1 root% iptables -t nat -A POSTROUTING -j MASQUERADE
Adding a route to Server1 through br0
root% ip route add 18.104.22.168 via 10.253.252.2 dev br0
And keep fingers crossed, but it does not work. Tried many different permutations of this.
Attempts Version 2
More recently, I tried a version closer to the one mentioned above with -j MARK for packet routing to no avail:
root% ip rule add fwmark 2 priority 1000 table 3 root% ip route add default via 10.0.0.1 table 3 root% ip route flush cache root% ip route flush table 3 root% iptables -t mangle -A OUTPUT -p tcp -s 22.214.171.124 -j MARK --set-mark 2 root% iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE root% ip route add 0.0.0.0/1 via 10.253.252.2 dev br0 table 3