Here is the network topology that I have:

Private network 1 --> IPFire Firewall 1 <---> IPFire Firewall 2 <-- Private network 2

I can ping from private network 1 to private network 2, that is after creating an IPsec tunnel between the two IPFire devices.

What I want to do is to have a middle device between the two IPFire devices, the network topology is like this:

Private network 1 --> IPFire Firewall 1 <-- middle device --> IPFire Firewall 2 <-- Private network 2

I want to use this middle device as a packet sniffer for the packets flawing between IPFire 1 and 2. What I don't know is how transfer the connection from one interface of the middle device to the second, the IPsec tunnel uses private IPs, so I don't know who the middle device will affect the tunnel establishment.

3 Answers 3


To easily see the traffic in it's encrypted state between the two firewalls which you own and manage. I suggest a hub. It requires no configuration, you simply plug in both firewall's outside interfaces and then plug in your laptop with monitoring tools (may need to adjust NIC settings/promiscuous etc) to see all the traffic flowing between the two devices.

  • 1. The middle device could be a laptop or one-board computer on which a Linux distribution is installed, although, I didn't figure out how to install the OS on the one-board computer I have, I have An ALIX board series 6 board. In the case of the laptop we will have to use the switch, right? 2. I want to see all the types of packets flawing between the IPsec devices. Commented Jun 18, 2014 at 15:28
  • In this case then you won't be able to from the 'middle', but just as good, you can set your device up just off the inside interface of your firewalls and get the same effect. If your firewalls support SPAN and you have enough ports for it you can mirror that way, otherwise as user5469 said you could introduce a switch or a tap right on the inside of the firewall to mirror/SPAN to your laptop.
    – A L
    Commented Jun 18, 2014 at 15:44
  • As we continue to clarify I'll edit my actual answer so it's helpful/relevant/clear for future viewers.
    – A L
    Commented Jun 18, 2014 at 15:45
  • The switch seems to be a good solution, I think. The topology is like net1>>IPFire1>>Switch>>IPFire2>>net2. I will connect the laptop to the switch, right? I don't actually know how to do port mirroring. And I really would like to apply this solution on virtualbox first! I don't know how to simulate a switch? Commented Jun 18, 2014 at 15:55
  • What you're listing here won't work, because (at least in your first post) - the two networks have an IPsec tunnel between them. So doing it the way you propose you'll get packets, but they'll all be encrypted and you won't be able to glean anything from your captures.
    – A L
    Commented Jun 18, 2014 at 16:04

I've never done this exactly, but my understanding is that you would want some sort of physical splitter in between to capture traffic to a 3rd (middle) device. Would depend on the type of physical layer1 connection. See link for an example of network tap solutions http://www.flukenetworks.com/enterprise-network/network-monitoring/Tap-Solutions


You could also put a switch in the middle and connect the sniffer to a mirror port. This will add another device to your setup but no special configuration will be needed on the sniffer.

  • Your suggestion seems promising, however I don't know much about how to configure this mirror port and how to connect it to the sniffer. Commented Jun 18, 2014 at 15:34
  • Basically you will have to connect the two firewalls to the switch on the same VLAN. Then connect the sniffer to another port and configure it as a mirror. The exact commands ton configure a mirror port depends on the switch model. In cisco it will look like: Switch# configure terminal Switch# monitor session 1 source interface fastethernet 0/1 Switch# monitor session 1 destination interface fastethernet 0/3
    – user5469
    Commented Jun 18, 2014 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.