Score:0

Route an incoming ICMP packet to a different interface/process

fr flag

I have an interface enp4s0 with several IPs.
I get ICMP packets (type 8, echo request) from external device to my device on enp4s0.
I'm trying to route only packets sent to 192.168.1.90 into another interface on the same device. On that interface there's a process which should handle these packets.

7: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:08:11:22:33:44 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.174/24 metric 1024 brd 192.168.1.255 scope global dynamic enp4s0
       valid_lft 2556122sec preferred_lft 2556122sec
    inet 192.168.1.90/24 scope global secondary enp4s0
       valid_lft forever preferred_lft forever
    inet6 fe80::208:a2ff:fe0c:f648/64 scope link 
       valid_lft forever preferred_lft forever

The interface I'm trying to route to is a tap interface which was added like this:

ip tuntap add tap0 mode tap
ip link set dev tap0 up
ip addr add 128.1.3.2/24 dev tap0

I have a little program which read()s from that interface. Because this program is running, the interface state is UP:

80: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 7a:0e:b7:37:f4:74 brd ff:ff:ff:ff:ff:ff
    inet 128.1.3.2/24 scope global tap0
       valid_lft forever preferred_lft forever
    inet6 fe80::780e:b7ff:fe37:f474/64 scope link 
       valid_lft forever preferred_lft forever

My intention is, that my app that reads from tap0 will answer the ICMP packets.
Using tcpdump and looking at my app's output, I can see traffic when I inject some packets using tcpreplay directly (tcpreplay -i tap0 ...)

Back to the routing -
I'm trying to route using:

# cat /proc/sys/net/ipv4/ip_forward
1
iptables -t nat -A PREROUTING -p icmp -j DNAT --to-destination 128.1.3.2

Note: the above iptables rule is a simplified form of what I'm trying to have (only icmp type 8, only packets with specific dst address, only from specific input interface. This is because I'm trying to first make it work).

This is the current routing table:

 ip r
default via 192.168.1.1 dev enp4s0 proto dhcp src 192.168.1.174 metric 1024 
...
128.1.3.0/24 dev tap0 proto kernel scope link src 128.1.3.2 linkdown 
192.168.1.0/24 dev enp4s0 proto kernel scope link src 192.168.1.174 metric 1024 
192.168.1.1 dev enp4s0 proto dhcp scope link src 192.168.1.174 metric 1024 

What I expected from all the above, is that all ICMP packets would get routed to the tap0 interface, which doesn't work.
When ICMPs are sent, I get reply immediately.
Looking at iptables -t nat -L -vnx I see my rules work, meaning there are hits on the above iptables rule.
But there's nothing on iptables -L FORWARD -vnx (default policy is ACCEPT).
Looking at iptables -L INPUT -vnx I can see the packets accepted.

Please help - is it possible to do this routing?

Score:0
fr flag

OK.
I re-read Forwarding ICMP response to TAP interface and now I understand the answer:

What does matter is the route to the TAP interface. That is, because of the implicit route added when the interface is brought up, any IP in 10.0.4.0/24 except 10.0.4.1.

# ip route get 10.0.4.1
local 10.0.4.1 dev lo src 10.0.4.1 uid 0 
    cache <local> 
# ip route get 10.0.4.2
10.0.4.2 dev tap0 src 10.0.4.1 uid 0 
    cache 

Anyway. I changed my iptables rule to a different IP, on the same subnet as tap0 and now it works! Thanks @A.B

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.