What I simply want is to redirect all HTTP packet from any interface to my tun/tap interface. A scapy script will listen on this interface and do some treatments to these packets.
First, I created a tun/tap interface:
sudo ip tuntap add mode tap tt0
I assigned an IP address as follow:
ifconfig tt0 10.0.0.1
Then, I added a mark with iptables as follow:
sudo iptables -t mangle -A OUTPUT -p tcp --dport 80 -j MARK --set-mark 1
I made a rule to route marked packet through table 2:
ip rule add fwmark 1 table 2
Finnaly, I added the route to the tt0 interface created above:
ip route add default via 10.0.0.1 table 2
A simple "curl google.com" will normally generate an HTTP request, and I should be able to see that packet with wireshark if I listen to the tt0 interface right? In fact, this is not the case...no traffic is present on tt0. Do I miss something? Thanks.