Packet Redirection on Windows

Question

We currently run windows on all of our machines due to software limitation.

Within this however, we are needing to redirect certain packets that come into an IP and Port to a different Port (same IP). We have software listening on the "Proxy Port".

This is achievable with IPTables on linux by doing something similar to:

iptables -t nat -I PREROUTING -p udp -d <DSTIP> --dport <DSTPORT> -m u32 --u32 '0>>22&0x3C@8=0xFFFFFFFF && 0>>22&0x3C@12=0x54536F75 && 0>>22&0x3C@16=0x72636520 && 0>>22&0x3C@20=0x456E6769 && 0>>22&0x3C@24=0x6E652051 && 0>>22&0x3C@28=0x75657279' -j REDIRECT --to-port <REDIRECT PORT>

This works great on linux and will redirect certain packets to our proxy software, however is it at all possible to do something such on windows without having to get a dedicated machine in-front of our windows machines?

I was thinking of writing something up with pcap.net but I'm guessing this will have to direct read from the NIC rather than windows?

Just out of curiousity: why do you need this? I think you'll be stuck with writing a filter driver for Windows or setting up a Linux (virtual) machine, I'm afraid.. — Thomas, Apr 08 '16 at 09:57

score 7 · Accepted Answer · edited Apr 13 '17 at 12:13

7

From the MSDN:

Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running.

You can redirect connections coming to any port to another local (or remote) port with the command:

netsh interface portproxy add v4tov4 listenaddress=localaddress listenport=localport connectaddress=destaddress connectport=destport

Also, as stated in this SO post, netsh is a good replacement for iptabes on Windows.

edited Apr 13 '17 at 12:13

Community

1
1

answered Apr 08 '16 at 13:07

This is almost what we need, except it needs to only forward certain traffic containing some payload to a new port rather than all traffic. – user1372896 Apr 10 '16 at 20:25

score 1 · Answer 2 · answered May 30 '18 at 10:49

Command

netsh interface portproxy ...

do port proxying but not packet forwarding. The main difference is

performace is much worse than iptables (f.e. see https://plus.google.com/+OlafMonien/posts/fsjUjropYeR)
source IP address is changed to localhost (127.0.0.1 or ::1 depends on IP version), you loose original request source IP address.

We had been using this technique to port forwarding but after those findings we had to use extra rules on network firewall to avoid usage of netsh.

Packet Redirection on Windows

2 Answers2