Mirroring all router traffic (openwrt) to a snort sensor?

Yes iptables TEE works. I have a tplink router and I am mirroring the traffic exactly for the same reason as you.

Install all the necessary modules and packages for TEE.

Assuming your monitoring IP address is 10.1.1.205, run:

iptables -A POSTROUTING -t mangle -o br-lan ! -s 10.1.1.205 -j TEE --gateway 10.1.1.205

iptables -A PREROUTING -t mangle -i br-lan ! -d 10.1.1.205 -j TEE --gateway 10.1.1.205

A patch for OpenWrt to enable port mirroring on your hardware is available, though it has received only limited testing. You can, of course, apply and test it yourself.

Tags:

Openwrt