title: local mitmproxy between dual NICs (iptables)
body: <p><b>Here's the physical layout:</b>
  <br>
  IOT_device--eth_cable--router2--eth_cable--usb_eth_interface--linux_box:internal_wifi~~wifi_connection~~router1--eth_cable--modem--internet</p>
  <p><b>Here's what I have successfully set up:</b>
  <br>
  router1 uses 192.168.1.x   (interface wlp0)<br>
  router2 uses 192.168.2.x   (interface eth0)<br>
  linux_box has a dedicated IPv4 address on each of the routers<br>
  router2 is set to use the address it has dedicated to linux_box as it's IPv4 gateway</p>
  <p><b>Here's what I'm trying to do:</b>
  <br>
  All packet that comes over router2, and arrive at linux_box on eth0, should go to mitmproxy where it can do its thing (including to analyze and decrypt TLSv1.3 traffic of an application with wireshark), and then the packets should continue to wlp0 and pass over router1 on the way to the internet.  I also want to catch everything that comes back from the internet in response to these outbound packets, similarly thru mitmproxy (and wireshark etc) before it is passed back across router2.</p>
  <p>I've lurked on SO for over a decade now, and this is the first time I have had a need to register an account so that I can ask a question.
  I want to make sure that absolutely nothing goes between router2 and router1 unless mitmproxy has done its business.</p>
  <p>I've read many examples of ways to do individual parts of what I want to do, but I can't figure out how to put all the part together (which is what I usually do when I need to solve a somewhat novel problem).  As far as I can tell, iptables rules are sufficient to accomplish this task... but then again, if I knew this to be certain, I would be reading the appropriate parts of the appropriate manuals instead of asking anyone else to take up their time to help.
  <br><br>
  The example iptables modifications for mitmproxy in transparent mode:
  <br>
  <code>sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080</code><br>
  <code>sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080</code>
  <br>
  don't provide me much assurance that everything is going to happen exactly as I want it to.  As far as I can tell, by consulting the iptables man pages, these just redirect eth0 ports 80 and 443 onto eth0 port 8080.
  Even if I were absolutely certain that IOT_device would only every attempt to (TLS) communicate over ports 80 and 443 (which I absolutely cannot be sure of), I am unable to confirm via documentation or internet searches (including searching SO), that mitmproxy will use wlp0 on the other-side.
  <br><br>
  <b>My question is:</b>
  What iptables rules do I need in-order to accomplish this goal?<br>
  <br>
  If I have the rules in front of me, I know that I can use the aforementioned resources to understand what the rules do, and therefore understand why they do what I want them to do.  However, if it is not possible to accomplish my goal with only the use of iptables rules, I am open to other methods.<br><br>
  Thank you for your time!</p>