TEE
The TEE target will clone a packet and redirect this clone to another machine on the local network segment. In other words, the nexthop must be the target, or you will have to configure the nexthop to forward it further if so desired.
--gateway ipaddr
Send the cloned packet to the host reachable at the given IP address. Use of 0.0.0.0 (for IPv4 packets) or :: (IPv6) is invalid.
To forward all incoming traffic on eth0 to an Network Layer logging box:
-t mangle -A PREROUTING -i eth0 -j TEE --gateway 2001:db8::1
which means I think your command is set up wrong. I would do more like the example.
but say you are to clone all incoming and outgoing traffic for a pc 192.168.1.15 on your router (say, 192.168.1.1). and redirect to a spying pc 192.168.1.100, use:
Code:
iptables -t mangle -A PREROUTING -d 192.168.1.15 -j TEE --gateway 192.168.1.100
iptables -t mangle -A PREROUTING -s 192.168.1.15 -j TEE --gateway 192.168.1.100
Anyone that has a good write up on getting TEE to work with DD-WRT?
From my understanding there are multiple missing pieces that prevent this:
- iptables is outdated and does not support mirroring
- kernel module for TEE is not built into DD-WRT
The above leads me to believe that even just updating iptables isn't going to work....
Anyone that has done mirroring with a recent version of DD-WRT want to chime in on how he did it? Unfortunately my router (DIR-880L) is not supported by any other open router software
Joined: 16 Nov 2015 Posts: 2886 Location: UK, London, just across the river..
Posted: Fri Mar 02, 2018 21:28 Post subject:
- iptables is outdated and does not support mirroring
- kernel module for TEE is not built into DD-WRT
correct
hmm i dont know i ve seen somewhere around someone made
success installing last version of iptables...via
entware....
sadly entware version of iptables have to be manually updated first... _________________ Atheros
TP-Link WR740Nv1 ------DD-WRT 33772 BS WAP/Switch (wired)
TP-Link WR1043NDv2 -----DD-WRT 41328 BS (AP,PPPoE,NAT,AD Blocking,AP Isolation,Firewall,Local DNS,Forced DNS,DoT)
TP-Link WR1043NDv2 -----DD-WRT 41321 BS (AP,NAT,AD Blocking,Firewall,Wi-Fi OFF,Local DNS,Forced DNS,DoT)
TP-Link WR1043NDv2 -----Gargoyle OS 1.11.0 (AP,NAT,QoS,Quotas)
Qualcomm/IPQ8065
Netgear R7800 ---------DD-WRT 40270M 4.9 Kong (AP,NAT,AD-Blocking,AP&Net Isolation,Firewall,Local DNS,DNSCrypt v2 x2)
Broadcom
Netgear R7000 ---------DD-WRT 40270M Kong (AP,NAT,VLAN,AD-Blocking,Firewall,Local DNS,Forced DNS,DoT)
------------------------------------------------------------------------------------------------
Stubby for DNS over TLS I DNSCrypt v2 via Entware by mac913
Depending on what you're trying to monitor, mirroring with iptables may not catch all traffic. It's only going to capture traffic that routes from LAN to WAN. If you are at all trying to capture LAN to LAN traffic a switch that can actually be put into port mirroring mode or something like a shark tap is what you might need
