2

I'm currently trying to get my setup to work.

[ victim ] --- [ mitm ] --- [ net ]

IPs:

  • net: 10.0.0.0/24
  • victim: 10.0.0.1
  • mitm: 10.0.0.2
  • gateway: 10.0.0.254

setup:

ip l a name br0 type bridge
ip l set br0 up
ip l set eth0 up
ip l set eth0 master br0
ip l set eth1 up
ip l set eth1 master br0

ip a a 10.0.0.2/24 dev br0
ip r a default via 10.0.0.254 dev br0

The bridge works, I can access the net from the victim.

Now I'd like to reroute port 445 to my proxy on the bridge for the victim so the victim has to access my proxy for Group Policies.

How do I achieve that?

iptables -t nat -I PREROUTING -p tcp --dport 445 -j REDIRECT --to-ports 445

does not help, unfortunately. (This is the setup I can use if I can force the victim in a subnet I activate myself, using routing on the mitm laptop instead of bridging network interfaces. The routing scenario is currently impossible.)

| improve this question | |
  • Welcome on Seucurity.SE. What you are trying to achieve seems to be a transparent proxy. As this question affect several domains, you will find information on how to setup a transparent proxy using IPTables on several site of the StackExchange network: IPTables configuration for Transparent Proxy, Transparent proxy and IPTABLES, iptables for transparent TCP proxy. – WhiteWinterWolf Jul 19 '17 at 9:20
  • Hi, thanks for the fast reply. I'm not entirely sure since most of those seem to be concerned with L3/routing the packets and I'm not yet convinced that those work with an L2 bridge as well. I seem to be unable to get the right conclusions from man iptables :( – David Mändlen Jul 19 '17 at 9:26
  • An HTTP proxy being a layer-7 thing, I'm not sure you can use it in a Layer-2 bridge. At most you can inspect the packets you are passing through (see Deep-packet-Inspection (DPI) technologies, this is different than setting up a proxy), but acting as a full-fledged protocol-level intermediary means that the proxy must be in measure of acting as a end-point in toward both hosts, which is not possible when the proxy has not access to layer-3 (no IP). – WhiteWinterWolf Jul 19 '17 at 9:39
  • Thanks, your answer pushed me in the right direction. I'll add my findings in case anybody else wants to use this in the future. – David Mändlen Jul 19 '17 at 12:07
2

Thanks to @whitewinterwolf I found a solution to the problem.

I had a wrong conception of how this proxy was supposed to work.

If you're looking for a c&p-solution, please see below.

# bridge setup as before
ip l a name br0 type bridge
ip l set br0 up
ip l set eth0 up
ip l set eth0 master br0
ip l set eth1 up
ip l set eth1 master br0

ip a a 10.0.0.2/24 dev br0
ip r a default via 10.0.0.254 dev br0

# now ensure that netfilter works on the l2 bridge
modprobe br_netfilter
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables

The reason it didn't work before is that iptables does not normally work on the second layer of the OSI model but on the third. Bridges are on the second layer and therefore don't care about PRE- or POSTROUTING activities. The br_netfilter kernel module enables exactly that. Afterwards you just have to turn on the functionality.

Networking is hard but fun.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.