1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Need a firewall rules to duplicate/forward all packets to specific IP.

Discussion in 'Tomato Firmware' started by premudriy, Oct 6, 2010.

  1. premudriy

    premudriy LI Guru Member

    Hello everyone,


    I'm writing a program that deals with SIP packets. I have a MagicJack phone running on my old laptop, but I am developing on another computer.

    I need somehow to redirect/retransmit packets which go to the laptop so that they would also go to my computer on which I am developing.

    I'm guessing that I can do it with a firewall rule, but my knowledge with iptables is limited. Is this even possible?

    If so, then what firewall rule will take all the packets and retransmit/duplicate/forward them to an additional IP on the network?
     
  2. rhester72

    rhester72 Network Guru Member

    modprobe ipt_ROUTE
    iptables -A PREROUTING -t mangle -p <protocol> --dport <port> -j ROUTE --gw <target> --tee

    where <protocol> is either udp or tcp (I'm guessing udp in your case), <port> is the port number (I seem to recall SIP uses 10000?), and <target> is the IP address you want to duplicate the packets to.

    You can safely put the above in your Firewall script.

    Rodney
     
  3. premudriy

    premudriy LI Guru Member

    Thank you for replying, Rodney!

    You know, your mentioning of port 10000 made me think about possible problem: I actually only need the SIP INVITE packets (to get Caller ID info) and according to wireshark those had destination port 62390 in my test. I have a feeling that destination port is not a pre-set one and changes, so the next time magic jack gets SIP invite from proxy, it might be on a different port. (am I right?)

    So, is it possible to duplicate a range of ports with that firewall rule above or will I need to put in a rule for every port that I want to duplicate/redirect?
     
  4. premudriy

    premudriy LI Guru Member

    Oh, ok, I see that SIP INVITE originate from 5070 always, so I used --sport 5070 instead of --dport and it works perfectly. Thank you again, Rodney!
     

Share This Page