ldx / python-iptables

Python bindings for iptables
730 stars 182 forks source link

Gateway parameter for TEE forwarding seems to be missing #312

Closed castaway2000 closed 3 years ago

castaway2000 commented 3 years ago

How would I implement the gateway parameter with this code snip? Cant seem to add it in. Should I convert this to a dictionary process?

import iptc
table = iptc.Table(iptc.Table.MANGLE)
chain = iptc.Chain(table, "PREROUTING")
rule = iptc.Rule()
rule.in_interface = "eth0"
rule.target = iptc.Target(rule, "TEE")
chain.insert_rule(rule)

The above code fails silently and does not register in iptables

According the docs from iptables for TEE forwarding state that it should be there as it is required for TEE to work and it looks like this example on superuser backs it up. Can you confirm how to do this?

TEE
The TEE target will clone a packet and redirect this clone to another machine on the local network segment. In other words, the nexthop must be the target, or you will have to configure the nexthop to forward it further if so desired.
--gateway ipaddr
Send the cloned packet to the host reachable at the given IP address. Use of 0.0.0.0 (for IPv4 packets) or :: (IPv6) is invalid.
To forward all incoming traffic on eth0 to an Network Layer logging box:

-t mangle -A PREROUTING -i eth0 -j TEE --gateway 2001:db8::1 
jllorente commented 3 years ago

You can use something like this with the easy module

iptc.easy.add_rule('mangle', 'PREROUTING', {'in-interface': 'eth0', 'target': {'TEE': {'gateway': '192.168.1.100'}}})

jllorente commented 3 years ago

In your example you are just missing adding the gateway attribute to the target:

import iptc
table = iptc.Table(iptc.Table.MANGLE)
chain = iptc.Chain(table, "PREROUTING")
rule = iptc.Rule()
rule.in_interface = "eth0"
rule.target = iptc.Target(rule, "TEE")
# This bit was missing
rule.target.gateway='192.168.1.100'
chain.insert_rule(rule)
castaway2000 commented 3 years ago

In your example you are just missing adding the gateway attribute to the target:

import iptc
table = iptc.Table(iptc.Table.MANGLE)
chain = iptc.Chain(table, "PREROUTING")
rule = iptc.Rule()
rule.in_interface = "eth0"
rule.target = iptc.Target(rule, "TEE")
# This bit was missing
rule.target.gateway='192.168.1.100'
chain.insert_rule(rule)

I wonder why this process didnt work for me i tried this for a few hours last night. I ended up using the following solution after looking at some other kinds of examples using the set_parameter method.

target = iptc.Target(rule, "TEE") target.set_parameter("gateway", "192.168.1.1")

ldx commented 3 years ago

Closing this based on the feedback, thanks @jllorente for helping out.