Port mirroring on Linux [closed]

Question

Closed. This question is off-topic. It is not currently accepting answers.

---

Want to improve this question? Update the question so it's on-topic for Stack Overflow.

Closed 8 years ago.

Improve this question

I have Kippo running on my VPS, and I can't get it to run under port 1024 due to restrictions in Linux not allowing normal accounts to use ports under 1024. If I try, it gives an error with some Python gibberish about not being able to listen on a port under 1024.

I'd rather not run Kippo run as root just in case some how they get out of the Kippo enviroment.

So what I'm looking at doing is using IPTables to "Mirror" all traffic going to port 2222 on 22 so that a "bot" can see SSH running on port 22 and do its thing.

Is that feasible? If so, how?

Answer 1

Use a DNAT rule:

iptables -t nat -A PREROUTING -m tcp -p tcp --dport 22 -j REDIRECT --to-port 2222

You may want to lock down further with specific IP address filters