3

I need to receive a TCP packet destined to my application, then resend it to another destination on the local network, while keeping the Original IP Address.

How can it be done, or how difficult is it?

I am using simple sockets in Java, running on a Linux environment, and I might consider using C libraries in my code if that does the trick.

I know routers or firewalls intercept such TCP packets, I am guessing they don't change the source IP.

  • 1
    You need to use raw sockets, see this: stackoverflow.com/questions/14873243/raw-socket-in-java – Aria Jan 19 '18 at 18:57
  • @Aria Is it simple, and is it reliable enough to run on an enterprise environment without surprises? Thx – abdelrahman-sinno Jan 19 '18 at 19:16
  • @united-expression: "reliable enough to run on an enterprise environment without surprises" - You usually need root access in order to send packets with which does not belong to you. You might not have this access in enterprise environments. Also the switches might be intelligent enough to discard packets where the source IP does not match the expected IP address for the source MAC address. – Steffen Ullrich Jan 19 '18 at 19:37
  • @Steffen Ullrich I will have root access, however about the switch, if the original ip address has never connected to it directly, can it still knows its expected MAC and block it? Not sure if I make sense but this looks like a deal breaker – abdelrahman-sinno Jan 20 '18 at 10:25
  • @united-expression: this depends on the actual switch and its configuration. It might be that the mapping between MAC and IP is centrally managed to prevent IP spoofing. Ask your network administrators about it. – Steffen Ullrich Jan 20 '18 at 10:31
1

This is achievable with TProxy in Linux, however I cannot say it has been very stable in testing.

I have implemented it in Java for TCP, had to use JNA to do native Linux library calls, as well as wrapping JRE Socket classes (based on this post, with extra changes done).

In summary, they steps are:

  • IPTables firewall module configuration.

  • Copy the address of the source socket.

  • Native library call to setsockopt with the IP_TRANSPARENT option, for the client socket to use the TProxy module.
  • Set the originating address in the outgoing socket

Apparently there are many implementations for it online, such as this one in Golang.

0
iptables -A PREROUTING -i eth0 -p tcp -m tcp -m multiport --dports 80 -j DNAT --to-destination 192.168.0.1

I don't know if this is what you want, but I forward traffic from my firewall to my web server all the time.

The web server logs has the originating IP source.

  • This is part of it, however in my answer I mention how you can a 'Middle-in-the-man' application, that may alter the source data or even send completely different data. – abdelrahman-sinno Jun 10 '18 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.