Core: dup-to support in firewall rules

[TransLunarInjection]

dup-to can be used to duplicate/mirror matching traffic to another system for analysis.

https://www.freebsd.org/cgi/man.cgi?query=pf.conf&sektion=5&n=1#ROUTING

The dup-to option creates a duplicate of the packet and routes it like route-to. The original packet gets routed as it normally would.

Not sure how to add this. Had a go at working out what to do:

• add mirror/duplicate/whatever it should be called here https://github.com/opnsense/core/blob/a591cf14123f4fab9e23e801c71c9abf3453170e/src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php#L47
• add corresponding parse function
• entry in firewall_rules_edit.php around here: https://github.com/opnsense/core/blob/2caa7fae6a6bf7311043dd5bd4d250c4cc2519ae/src/www/firewall_rules_edit.php#L1218

What else would need changed?

[AdSchellevis]

That should basically be it, together with some validations if they apply (in the rules edit file).
Out of curiosity, what is the use case for this?

[TransLunarInjection]

It's more targeted than port mirroring on a switch as you have the full set of port/host/src/destination/protocol/etc to choose for matching.

I wanted to try mirroring some (but not all) traffic to snort running on another more powerful machine.

[AdSchellevis]

I see, could be practical indeed.

[TransLunarInjection]

There's an open freebsd bug which claims dup-to doesn't work so there might not be any point. :( https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=203715

To develop and test this, I can fork this repo, make changes, then run opnsense-code and point it to my fork. Is that the right approach?

[AdSchellevis]

maybe you better try the pf rules first then, edit /tmp/rules.debug and reload using

pfctl -f /tmp/rules.debug

if you only need to work on core, you can fork and pull to your OPNsense box and install from there.

[fichtner]

Tagging this "support" for now, can always transform into feature ticket. :)

[TransLunarInjection]

Never managed to get it working with manually created rules - seems to be broken. Not sure if that's broken in general or due to changes made by OPNsense but there doesn't seem to be much point keeping this ticket open.

No-one else has requested it, and port mirroring with a managed switch allows you to do nearly the same thing (as long as you don't mind extra traffic if you were trying to match something more specific)