I need to establish a TCP connection where the client is spoofing its IP for all outgoing traffic. My first attempt was to add a rule to the POSTROUTING chain like so:
iptables -t nat -A POSTROUTING -p tcp --dport 5555 -j SNAT --to-source 192.168.1.1
This works for the SYN packet, but does not catch and rewrite the ACK coming from the client. My understanding is that this is because the ACK only passes through the OUTPUT chain, never hitting POSTROUTING. My next attempt was to use xtables-addons and do raw SNAT like so:
iptables -t raw -A OUTPUT -p tcp --dport 5555 -j RAWSNAT --to-source 192.168.1.1
iptables gives me an error on this command based on the target. I believe it is based on the target because -j DROP and -j ACCEPT both work. The man page specifically says that RAWSNAT is valid in the OUTPUT chain and I have verified that the xt_nat.ko module is loaded....
Does anyone have insight into what is going on with RAWSNAT or have a way to get ALL of the outgoing connection traffic to pass through the POSTROUTING chain in the nat table? I have not been able to figure out if MARK or CONNMARK can help me here based on the documentation I have read.