iptables missing --gateway flag for -j TEE

[ghost]

SUMMARY

The ip_tables module is missing a flag called gateway that is invoked with the -jump TEE extension.

iptables -t mangle -A PREROUTING -i bond0 -p udp --dport 9521 -m state --state NEW,ESTABLISHED,RELATED -j TEE --gateway 127.0.0.1

Does anyone know how this cold be accomplished?

ISSUE TYPE

• Feature Idea
• Documentation needed

COMPONENT NAME

iptables

ADDITIONAL INFORMATION

This is needed to forward data to the local machine.
The use case is there are two rules, one for routing to local machine, and one rule for routing to destination machine.

iptables -t mangle -A PREROUTING -i bond0 -p udp --dport 9521 -m state --state NEW,ESTABLISHED,RELATED -j TEE --gateway 127.0.0.1
iptables -t nat -A PREROUTING -i bond0 -p udp --dport 9521 -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to-destination <dest_ip>:9501

- name: IP Tables for sending to local RR
  iptables:
    table: mangle
    chain: PREROUTING
    in_interface: bond0
    protocol: udp
    match: state
    ctstate:
      - "NEW"
      - "ESTABLISHED"
      - "RELATED"
    destination_port: "{{ item.ingester_port }}"
    jump: TEE
    destination: 127.0.0.1
    comment: "Send web traffic to local port {{ item.ingester_port }}"
  with_items:
    - { "ingester_port": 9521 }
  become: yes

- name: IP Tables for sending to remote ingester
  iptables:
    table: nat
    chain: PREROUTING
    in_interface: bond0
    protocol: udp
    match: state
    ctstate:
      - "NEW"
      - "ESTABLISHED"
      - "RELATED"
    destination_port: "{{ item.ingester_port }}"
    to_ports: "{{ item.rr_port }}"
    jump: DNAT
    destination: <dest_ip>
    comment: "Redirect web traffic to port {{ item.rr_port }}"
  with_items:
    - { "ingester_port": 9521, "rr_port": 9501 }
  become: yes

TASK [ingester-classifiers : IP Tables for sending to localhost] *********************************************************************
failed: [desthost] (item={u'ingester_port': 9521}) => {"changed": false, "cmd": "/sbin/iptables -t mangle -A PREROUTING -p udp -d 127.0.0.1 -m state -j TEE -i bond0 --destination-port 9521 -m comment --comment 'Send web traffic to local port 9521' --state NEW,ESTABLISHED,RELATED", "item": {"ingester_port": 9521}, "msg": "iptables v1.4.21: TEE: option \"--gateway\" must be specified\n\nTry `iptables -h' or 'iptables --help' for more information.", "rc": 2, "stderr": "iptables v1.4.21: TEE: option \"--gateway\" must be specified\n\nTry `iptables -h' or 'iptables --help' for more information.\n", "stderr_lines": ["iptables v1.4.21: TEE: option \"--gateway\" must be specified", "", "Try `iptables -h' or 'iptables --help' for more information."], "stdout": "", "stdout_lines": []}
	to retry, use: --limit @/etc/ansible/playbooks/ingesters.retry

[ansibot]

Files identified in the description:

• lib/ansible/modules/system/iptables.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

cc @LinusU @sebastiendarocha
click here for bot help

[Akasurde]

resolved_by_pr #53465