I have an interface enp4s0
with several IPs.
I get ICMP
packets (type 8, echo request) from external device to my device on enp4s0
.
I'm trying to route only packets sent to 192.168.1.90
into another interface on the same device. On that interface there's a process which should handle these packets.
7: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:08:11:22:33:44 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.174/24 metric 1024 brd 192.168.1.255 scope global dynamic enp4s0
valid_lft 2556122sec preferred_lft 2556122sec
inet 192.168.1.90/24 scope global secondary enp4s0
valid_lft forever preferred_lft forever
inet6 fe80::208:a2ff:fe0c:f648/64 scope link
valid_lft forever preferred_lft forever
The interface I'm trying to route to is a tap
interface which was added like this:
ip tuntap add tap0 mode tap
ip link set dev tap0 up
ip addr add 128.1.3.2/24 dev tap0
I have a little program which read()
s from that interface. Because this program is running, the interface state is UP:
80: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 7a:0e:b7:37:f4:74 brd ff:ff:ff:ff:ff:ff
inet 128.1.3.2/24 scope global tap0
valid_lft forever preferred_lft forever
inet6 fe80::780e:b7ff:fe37:f474/64 scope link
valid_lft forever preferred_lft forever
My intention is, that my app that reads from tap0
will answer the ICMP
packets.
Using tcpdump
and looking at my app's output, I can see traffic when I inject some packets using tcpreplay
directly (tcpreplay -i tap0 ...
)
Back to the routing -
I'm trying to route using:
# cat /proc/sys/net/ipv4/ip_forward
1
iptables -t nat -A PREROUTING -p icmp -j DNAT --to-destination 128.1.3.2
Note: the above iptables
rule is a simplified form of what I'm trying to have (only icmp
type 8, only packets with specific dst address
, only from specific input interface. This is because I'm trying to first make it work).
This is the current routing table:
ip r
default via 192.168.1.1 dev enp4s0 proto dhcp src 192.168.1.174 metric 1024
...
128.1.3.0/24 dev tap0 proto kernel scope link src 128.1.3.2 linkdown
192.168.1.0/24 dev enp4s0 proto kernel scope link src 192.168.1.174 metric 1024
192.168.1.1 dev enp4s0 proto dhcp scope link src 192.168.1.174 metric 1024
What I expected from all the above, is that all ICMP
packets would get routed to the tap0
interface, which doesn't work.
When ICMP
s are sent, I get reply immediately.
Looking at iptables -t nat -L -vnx
I see my rules work, meaning there are hits on the above iptables
rule.
But there's nothing on iptables -L FORWARD -vnx
(default policy is ACCEPT
).
Looking at iptables -L INPUT -vnx
I can see the packets accepted.
Please help - is it possible to do this routing?