I have an interface enp4s0 with several IPs.
I get ICMP packets (type 8, echo request) from external device to my device on enp4s0.
I'm trying to route only packets sent to 192.168.1.90 into another interface on the same device. On that interface there's a process which should handle these packets.
7: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether 00:08:11:22:33:44 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.174/24 metric 1024 brd 192.168.1.255 scope global dynamic enp4s0
valid_lft 2556122sec preferred_lft 2556122sec
inet 192.168.1.90/24 scope global secondary enp4s0
valid_lft forever preferred_lft forever
inet6 fe80::208:a2ff:fe0c:f648/64 scope link
valid_lft forever preferred_lft forever
The interface I'm trying to route to is a tap interface which was added like this:
ip tuntap add tap0 mode tap
ip link set dev tap0 up
ip addr add 128.1.3.2/24 dev tap0
I have a little program which read()s from that interface. Because this program is running, the interface state is UP:
80: tap0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 7a:0e:b7:37:f4:74 brd ff:ff:ff:ff:ff:ff
inet 128.1.3.2/24 scope global tap0
valid_lft forever preferred_lft forever
inet6 fe80::780e:b7ff:fe37:f474/64 scope link
valid_lft forever preferred_lft forever
My intention is, that my app that reads from tap0 will answer the ICMP packets.
Using tcpdump and looking at my app's output, I can see traffic when I inject some packets using tcpreplay directly (tcpreplay -i tap0 ...)
Back to the routing -
I'm trying to route using:
# cat /proc/sys/net/ipv4/ip_forward
1
iptables -t nat -A PREROUTING -p icmp -j DNAT --to-destination 128.1.3.2
Note: the above iptables rule is a simplified form of what I'm trying to have (only icmp type 8, only packets with specific dst address, only from specific input interface. This is because I'm trying to first make it work).
This is the current routing table:
ip r
default via 192.168.1.1 dev enp4s0 proto dhcp src 192.168.1.174 metric 1024
...
128.1.3.0/24 dev tap0 proto kernel scope link src 128.1.3.2 linkdown
192.168.1.0/24 dev enp4s0 proto kernel scope link src 192.168.1.174 metric 1024
192.168.1.1 dev enp4s0 proto dhcp scope link src 192.168.1.174 metric 1024
What I expected from all the above, is that all ICMP packets would get routed to the tap0 interface, which doesn't work.
When ICMPs are sent, I get reply immediately.
Looking at iptables -t nat -L -vnx I see my rules work, meaning there are hits on the above iptables rule.
But there's nothing on iptables -L FORWARD -vnx (default policy is ACCEPT).
Looking at iptables -L INPUT -vnx I can see the packets accepted.
Please help - is it possible to do this routing?