Duplicate traffic while spoofing an interface

Joy

6/1/24, 4:47 PM

to sum up my issue, I have a linux router that has 3 network interfaces:

a wlan interface acting as a DHCP server, upon which I manage the device, not in the scope of this question.
a lan interface, which is linked to the eth0 device (ethernet port), which is unmanaged.
a wan interface, which is linked to the eth1 device (ethernet port), which is unmanaged.

If that changes anything, my router is running on openwrt, so lan is actually br-lan.

My goal is twofold:

I need to plug my device on lan and wan between a station (connected to eth0) and a switch (connected to eth1), and act as a transparent bridge between them.
I need to be able to send and receive packet to and from the linux router spoofing the station.

The transparent bridge part is easily done with net.ipv4.ip_forward and adding eth1 into the virtual bridge device with eth0. However, as soon as I assign the station's IP/MAC to eth1, all traffic from the switch meant for the station is stopped at eth1 (understandably). I can ping the switch, but the station can't because eth1 keeps the response for itself.

To bypass this, I tried multiple things, mostly from this issue: iptables with tee (which straight up didn't work, even though I made a route that routed traffic for the station IP through eth0), iptables forwarding (see this issue), tcpbridge from eth1 to eth0, tc...

But in all these cases, packets from the switch meant for the station are redirected to eth0 as expected, but now the linux device is the one not receiving answers, meaning the station can ping the switch, but when I do, the station gets the response. (Even though eth1 is still spoofing the IP/MAC of the station).

Anyone got an idea why mirroring traffic actually doesn't work in my case ?
Is it because both interface or in the same vbridge?
Is there a packet utility that allow me to route packet by wrapping them with a custom IP/MAC? That would allow me to do a transparent bridge without tampering with eth1's IP/MAC.

Thanks!

1 + 0

networking

iptables

openwrt

spoofing

Score:0

Server

Joy

6/2/24, 12:06 PM

Okay i seem to have found the answer, I un-bridged the 2 interfaces and added mirror traffic control rules in each direction:

tc qdisc add dev eth0 ingress
tc qdisc add dev eth1 ingress
tc filter add dev eth0 parent ffff: protocol all u32 match u32 0 0 action mirred egress mirror dev eth1
tc filter add dev eth1 parent ffff: protocol all u32 match u32 0 0 action mirred egress mirror dev eth0

More info here and on the first issue I linked).

Now I can ping the server and both the station and the linux device get the response. There probably is a way to filter which packets are really for which, some utility relying on tcp flags or such, but I couldn't find any.

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Duplicate traffic while spoofing an interface

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.