Sample Header Ad - 728x90

NFT Tables: modify DUP packet

2 votes
0 answers
70 views
I have a server **H** with two NICs with ip address 192.168.105.10 and 192.168.104.10. An application running on **H** receives data from server **C** on UDP port 1703. Server **C** IP address is 192.168.105.14 I want to duplicate the incoming UDP packets and send them to server **D**, where another application listens on 192.168.104.11 also on port 1703. **H** runs debian 11 (kernel 5.10). So far I have the following NFT table setup on **H**:
#!/sbin/nft -f

table ip route_C_packets
delete table ip route_C_packets

table ip route_C_packets {
    chain C_in {
         type filter hook prerouting priority 0; policy accept;
         ip saddr "192.168.105.14" udp port 1703 ip daddr set "192.168.104.11" dup to "192.168.104.11" ip daddr set "192.168.105.10"
    }
}
This works, however it seems a bit ugly. From my understanding: ip saddr "192.168.105.14" udp port 1703: filter only UDP packets from **C** on the port I am interested in ip daddr set "192.168.104.11: overrides the destination address (so that the application running on **D** can actually receive them) dup_to "192.168.104.11": duplicates the packet and sends it to **D**, but does not modify daddr by itself ip daddr set "192.168.105.10": restores the original destination address for the *non duplicated* packet so that the application running on **H** can actually receive it. This trick of changing daddr and then restoring it back seems wrong to me, is there any syntax to set daddr *on the duplicated packet* rather than on the original one? **EDIT**: Everything here has netmask 255.255.255.0. 168.105 and 168.104 are effectively two segregated networks.
Asked by sbabbi (121 rep)
Jul 20, 2024, 11:00 PM
Last activity: Mar 4, 2025, 09:20 PM