iptables --tee for port mirroring

[natt]

Hello,

I have a dd-wrt based router and I'm using iptables to mirror EQ traffic to my SEQ box. It IS working, so maybe I should leave it at that -- but it seems like there must be a more efficient way of doing it.


# 192.168.1.103 is SEQ box
# works, but EVERYTHING on the network gets mirrored to my SEQ box-- overkill
iptables -A PREROUTING -t mangle -j ROUTE --gw 192.168.1.103 --tee
iptables -A POSTROUTING -t mangle -j ROUTE --gw 192.168.1.103 --teeIt seems like I should be able to just route the traffic bound for my EQ box. But when I try this:

# this almost works, but not quite (.101 is EQ box)
iptables -A PREROUTING -t mangle -d 192.168.1.101 -j ROUTE --gw 192.168.1.103 --tee
iptables -A POSTROUTING -t mangle -d 192.168.1.101 -j ROUTE --gw 192.168.1.103 --tee ...the zone loads, mobs load and con correctly but my player never shows up. Is there some UDP traffic that's not mirrored in method #2 maybe? any thoughts on how I might match it?

Thanks in advance,
-Natt

[brainiac]

you need the traffic heading towards the internet from your eq box forwarded as well.

don't know the iptables config for that, but the player movement data comes from the client.

[ieatacid]

I too have dd-wrt on my router. So doing this, I could eliminate using my 10mbs hub?

[natt]

I too have dd-wrt on my router. So doing this, I could eliminate using my 10mbs hub?
correct. No hub, no ettercap, just my dd-wrt switch (linksys wrt54g v3) and the SEQ box nic in promisc mode. I did have to upgrade dd-wrt to svn revision 12424 for the --tee command to work properly, with v24-sp2 it failed silently to add the rule.

The best part for me is that my SEQ box is a laptop and I don't have to use the wired network that my EQ box is on... packets are mirrored/routed over to it just fine on the wireless ;)

As I mentioned, everything that goes through the switch gets mirrored to that IP, so that might be a concern for some people. I may add some extra rules to stop some obvious non-EQ traffic from getting mirrored, but I'm not sure if it's really an issue or not.

any way, hope this helps someone,
-Natt

[natt]

you need the traffic heading towards the internet from your eq box forwarded as well.

don't know the iptables config for that, but the player movement data comes from the client.

I think that's it, thanks! At least at a glance, it appears to be working:


# mirror all the EQ box's incoming traffic to SEQ box
iptables -A PREROUTING -t mangle -d 192.168.1.101 -j ROUTE --gw 192.168.1.103 --tee
iptables -A POSTROUTING -t mangle -d 192.168.1.101 -j ROUTE --gw 192.168.1.103 --tee
# also mirror all the EQ box's outgoing traffic to SEQ box
iptables -A PREROUTING -t mangle -s 192.168.1.101 -j ROUTE --gw 192.168.1.103 --tee
iptables -A POSTROUTING -t mangle -s 192.168.1.101 -j ROUTE --gw 192.168.1.103 --teeplayer position is updating, everything looks good. Again, 192.168.1.101 is EQ box, 192.168.1.103 is SEQ. This is working on DD-WRT v24 svn "NEWD" build 12424. And instead of mirroring everything on the LAN like the first post, it's just the traffic to/from the target EQ box.

sweeet!
-Natt