Mirroring all router traffic (openwrt) to a snort sensor?
Yes iptables TEE works. I have a tplink router and I am mirroring the traffic exactly for the same reason as you.
Install all the necessary modules and packages for TEE.
Assuming your monitoring IP address is 10.1.1.205
, run:
iptables -A POSTROUTING -t mangle -o br-lan ! -s 10.1.1.205 -j TEE --gateway 10.1.1.205
iptables -A PREROUTING -t mangle -i br-lan ! -d 10.1.1.205 -j TEE --gateway 10.1.1.205
A patch for OpenWrt to enable port mirroring on your hardware is available, though it has received only limited testing. You can, of course, apply and test it yourself.