Redirect all outgoing http and https requests to Burp using nftables

Question

I'm working on a very limited client (based on Poky from the Yocto Project), on which I want to redirect all http/https requests to my other machine on the same network. I have nftables available on the target and verified this, by successfully dropping all packets directed to port 80.

sysctl net.ipv4.ip_forward shows 1.

I've tried using the following script/list of nft commands:

nft flush ruleset

nft add table ip nat
nft add chain ip nat prerouting { type nat hook prerouting priority 0 \; }
nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }

nft add rule ip nat prerouting tcp dport 80 dnat to 10.0.0.2:8080
nft add rule ip nat prerouting tcp dport 443 dnat to 10.0.0.2:8080

nft add rule ip nat postrouting masquerade

nft list ruleset

To test the setup, I've set the domain test.test to 10.0.0.2 (via /etc/hosts) on the client. On my second machine, I have Burp listening on all interfaces on port 8080 and a simple webserver on port 80 (python3 -m http.server 80).

Then I run curl http://test.test on the client. I get the directory listing from my Burp machine, but no redirect trough burp occurs.

What else could I try, to force all outgoing packets to port 80 or 443 to go through my Burp. Certificate issues can be ignored for the base setup.

Answer 1

In my very specific use-case, it seems like I need to address the output chain, instead of the prerouting chain. The following setup works for me:

nft flush ruleset

nft add table nat
nft add chain ip nat output { type nat hook output priority 0 \;}

nft add rule ip nat output tcp dport 80 dnat to 10.0.0.2:8080
nft add rule ip nat output tcp dport 443 dnat to 10.0.0.2:8080

nft list ruleset

Stackexchange seems to think this is a duplicate of the original question, so I'll ad a tad more information. I need to use the output hook in this case, instead of prerouting. This becomes apparent once reading the description of the hooks (from https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains):

prerouting: sees all incoming packets, before any routing decision has been made. Packets may be addressed to the local or remote systems. output: sees packets that originated from processes in the local machine.