How to takeover forwarded tcp streams in Linux? [closed]

Question

I have some TCP streams which are only going over my linux box. In theory, it only packet forwards them. Now some new idea happened on which now I think, it would be much better to also alter their content.

My idea is that the forwarded tcp stream should be handled as if it would be an incoming stream, and then processed by my own tools.

Is it somehow possible? I think, somehow the packet should be handled as if it had been sent to the machine and not for forwarding, in an early phase of the handling of the incoming packets.

Answer 1

@telcoM explained a very useful solution: the REDIRECT target of the PREROUTING iptables section. That affects incoming packets before their target is decided (will they be forwarded or handled by a local socket).

iptables -t nat -A PREROUTING -p tcp --dport <orig dest port> -j REDIRECT --to-ports <new local port>

He also mentions, encrypted protocols tend to fight exactly this, because it can lead to MiTM attacks. However, in the lack of the intent to eavesdrop or alter the content, this is probably not a serious problem.

Another important thing is that this solution destroys the information of the original destination port and address. There is no easy way to do it significantly differently.