3

I need to receive a TCP packet destined to my application, then resend it to another destination on the local network, while keeping the Original IP Address.

How can it be done, or how difficult is it?

I am using simple sockets in Java, running on a Linux environment, and I might consider using C libraries in my code if that does the trick.

I know routers or firewalls intercept such TCP packets, I am guessing they don't change the source IP.

Improve this question
6
  • 1
    You need to use raw sockets, see this: stackoverflow.com/questions/14873243/raw-socket-in-java
    – Aria
    Jan 19, 2018 at 18:57
  • @Aria Is it simple, and is it reliable enough to run on an enterprise environment without surprises? Thx
    – abdelrahman-sinno
    Jan 19, 2018 at 19:16
  • @united-expression: "reliable enough to run on an enterprise environment without surprises" - You usually need root access in order to send packets with which does not belong to you. You might not have this access in enterprise environments. Also the switches might be intelligent enough to discard packets where the source IP does not match the expected IP address for the source MAC address.
    – Steffen Ullrich
    Jan 19, 2018 at 19:37
  • @Steffen Ullrich I will have root access, however about the switch, if the original ip address has never connected to it directly, can it still knows its expected MAC and block it? Not sure if I make sense but this looks like a deal breaker
    – abdelrahman-sinno
    Jan 20, 2018 at 10:25
  • @united-expression: this depends on the actual switch and its configuration. It might be that the mapping between MAC and IP is centrally managed to prevent IP spoofing. Ask your network administrators about it.
    – Steffen Ullrich
    Jan 20, 2018 at 10:31

2 Answers 2

Reset to default
1

This is achievable with TProxy in Linux, however I cannot say it has been very stable in testing.

I have implemented it in Java for TCP, had to use JNA to do native Linux library calls, as well as wrapping JRE Socket classes (based on this post, with extra changes done).

In summary, they steps are:

  • IPTables firewall module configuration.

  • Copy the address of the source socket.

  • Native library call to setsockopt with the IP_TRANSPARENT option, for the client socket to use the TProxy module.
  • Set the originating address in the outgoing socket

Apparently there are many implementations for it online, such as this one in Golang.

Improve this answer
0 
iptables -A PREROUTING -i eth0 -p tcp -m tcp -m multiport --dports 80 -j DNAT --to-destination 192.168.0.1

I don't know if this is what you want, but I forward traffic from my firewall to my web server all the time.

The web server logs has the originating IP source.

Improve this answer
1
  • This is part of it, however in my answer I mention how you can a 'Middle-in-the-man' application, that may alter the source data or even send completely different data.
    – abdelrahman-sinno
    Jun 10, 2018 at 20:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .