Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to come up with an iptables rule whereby I can redirect all tcp traffic incoming on eth0 to 127.0.0.1:1234. I will then listen on 127.0.0.1 with my C program and print the raw packets to console. Is this possible? Or am I going about this in completely the wrong way?

Please bear in mind that my iptables knowledge is very limited.

Here's what I've tried sofar:

sudo iptables -A INPUT -s 127.0.0.1 -p tcp -j DROP

but I don't want to DROP - I want to forward to 127.0.0.1:1234!

share|improve this question
    
… what are you actually trying to accomplish? I guarantee you there's a better way to do things if you just tell us what you're trying to do here. –  MikeyB Mar 15 '12 at 16:04
    
Perhaps a honeypot? –  qroberts Mar 15 '12 at 16:06
    
Why not using Wireshark? –  ghm1014 Mar 15 '12 at 16:14

2 Answers 2

First enable routing:

 echo 1 > /proc/sys/net/ipv4/ip_forward

Try this:

iptables -A PREROUTING -t nat -p tcp -i eth0  -j DNAT --to 127.0.0.1:1234

Optional to hide the real IP: iptables -t nat -A POSTROUTING -j MASQUERADE

share|improve this answer
    
I think MASQUERADE is not necessary, will hide real source IP –  ghm1014 Mar 15 '12 at 16:15

It's a much better idea to configure iptables to send the packets to your process using netlink (search for NFLOG in the iptables manpage) or just capture raw traffic with libpcap.

This way you won't lose information and you'll keep things simple.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.