I have a dedicated Linux (Debian 7.5) root server, with a number of guests set up. The guests are KVM instances, and get network access via bridge-utils (NAT, internal IPs, use the host as a gateway).

E.g. one KVM is my WebServer guest, and it gets accessible via the host IP this way:

    iptables -t nat -I PREROUTING -p tcp -d 148.251.Y.Z 
--dport 80 -j DNAT --to-destination  192.168.100.X:80 

I do the same with other services, keeping them self-contained, NATed and isolated.

But one guest is supposed to be a network monitor, and shall perform network traffic inspection (like an IDS). Usually, in a non virtual setup I would use VACLs or SPAN ports to mirror the traffic. Of course, inside this one host, I cannot do this (easily, because I don't want to use complex virtual switching approaches).

  1. Can I get a port mirror using iptables, and redirect all ingress and egress traffic to one KVM guest? All guests have a dedicated interface, like vnet1.
  2. Is it possible to selectively forward traffic, based on the protocol (like a VACL forward rule, which only grabs HTTP)?
  3. do the guests need a specific interface setup, when I need to keep vnet1 as a management interface (with an IP)?

I would be happy for a point into the right direction:

iptables         1.4.14-3.1
linux            3.2.55
bridge-utils     1.5-6

Thanks a lot :)

1 Answer 1


what about prepending the root server pre-Routing module Mangle table rules by something like:

iptables -I PREROUTING -t mangle -j ROUTE --gw --tee

and then prepending the post-Routing module Mangle table rules by something like

iptables -I POSTROUTING -t mangle -j ROUTE --gw --tee 

where is the network monitor.

These rules will mirror all the incoming and outcoming traffic forwarding it to


mangle table specific
  -j ROUTE            (explicitly route packets, valid at PREROUTING)
      --iface <iface_name>
      --ifindex <iface_idx> 

but you could also use use something like

iptables -I PREROUTING –t mangle –i eth0 –j TEE –gateway


iptables -I POSTROUTING –t mangle –j TEE –gateway

where TEE now is a target which at PREROUTING takes more options like i.e. -i, -p, etc


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.