How to duplicate the traffic using IPTables? Is it possible?

linck · n00b Joined: 13 Mar 2005 Posts: 20 Location: Brasil

Hello.

I would like to know if there is a way to duplicate the traffic comming from one interface to another two network interface cards using IPTables. Is that possible?
For example: The traffic comming from eth0 should be duplicated and forwarded to eth1 and eth2, and the traffic comming from eth1 should be also duplicated and forwarded to eth2. I had been looking for iptables rules that could do that at google but I didn't find good results :cry:

Thank you.

mark_lagace · Posted: Sun Nov 12, 2006 2:12 am Post subject:

Is that something that would be done with iptables, or should you instead look into routing? I'm not sure what you mean by 'forwarded' I guess... For bridging one interface to another you could look into ebtables as well - I don't have enough experience with ebtables though to know if you can set up a one-to-many bridge.

linck · n00b Joined: 13 Mar 2005 Posts: 20 Location: Brasil

mark_lagace · Posted: Sun Nov 12, 2006 3:50 am Post subject:

Look into ethernet bridging and see if that serves your needs. http://tldp.org/HOWTO/html_single/Ethernet-Bridge-netfilter-HOWTO/ is a good spot to start. What a bridge can do is link your three ethernet interfaces so that traffic from one interface will be passed along to the others. Basically it turns your linux-box into a glorified ethernet switch. If you want to still have remote access to your linux machine, don't forget to assign an ip to the bridge virtual interface.

Good luck!

EDIT: better documentation: http://linux-net.osdl.org/index.php/Bridge

daeghrefn · Tux's lil' helper Joined: 02 Jan 2005 Posts: 112

I'm pretty sure you should be able to do this. It sounds to me like the same thing as putting two computers on a hub and using the second to monitor the traffic from the first.

I couldn't tell you exactly how, but I would assume that in the prerouting you would be able to copy all packets. I would also check the Netfilter configuration in the kernel... I don't have a box in front of me that I can do that, but I think I've seen stuff in there for auditing. I assume that's what this is for... network traffic logging/auditing.

HTH.
_________________
Support our troops.

linck · n00b Joined: 13 Mar 2005 Posts: 20 Location: Brasil

mark_lagace · Posted: Sat Nov 18, 2006 12:27 am Post subject:

Could you use something like this to take all packets coming in to 192.168.100.5 and forward them on to 192.168.120.1 through 192.168.120.5 (or however many you like)?