0

The situation:

  • A tcp packet arrives on eth0 with destination 8.8.8.8.
  • This packet meets some criteria that makes me want to intercept it (lets say I am interested in all packets from source 10.0.0.5 or all packets on port 80).
  • The packet is singled out with an iptables rule so that I can do something funky to it.

Rather than ignoring the packet or routing it to its correct destination, what can I do to send it to the local ip stack so that any program listening on the correct port recieves it?


To clarify: I do not want to modify the destination ip of the packet, and I do not want to spoof the destination ip to the whole network - I only want to steal packets I can match with an iptables rule.

I have tried iptables -j REDIRECT but it seems either not to be able to do this
I have also thought of creating a temporary interface that accepts packets from all ips and using iptables to sent the packets of intrest to it, but according to what I have read that will cause linux to seal every packet it sees because it thinks it has a valid destination ip for all of them, even if routing is turned off.

The solution does not have to be exclusive to tcp as long as it works with tcp.

Is there any way to do this?

1

It should be possible to do this using REDIRECT on IPTables. There are a couple of things not mentioned about your attempts here, and which may have been overlooked - ie it needs to use the prerouting chain (or output chain, but probably not here). It also, I think, requires to use the NAT table:

  1. You will want to use something like iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8000

  2. You need a program running on port 8000 on the local machine to actually handle the requests.

  3. You might need to tune your stack, for example enabling ip forwarding, enable send_redirects depending on your usage case.

A thought for you - what you are trying to do has been solved under Linux for "transparent proxying", so using guides like this one can get you a long way towards your goal.

You may also want to clean up your definition of "all packets on port 80" - that would probably not work if the answer was given to the question you actually asked - I suspect you mean all packets destined for port 80 - which is very different to all packets received FROM port 80 as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.