I understand that in order to ARP spoof a victim in a network using Scapy, we need to send ARP reply packets to the victim and the gateway router with the correct destination and Source IP address, but with the attacker's source Mac Address, essentially stating that the attacker is the gateway to the victim, and the victim to the gateway, hence being the man in the middle. Also the attacker would need to echo 1 to /proc/sys/net/ipv4/ip_forward to enable ip forwarding
So my question is, after arp poisoning the victim and the gateway, how will the victim's traffic be redirected to the router, and router's response traffic to be redirected back to the victim? Will the attacker need to change up the firewall configurations in iptable? Such as in the pre-routing chain of the nat table, redirecting victim's traffic tcp port 80, and 443 to the gateway IP, and also forwarding the router response packets (src port 80/443) back to the victim?
Since most of the examples on the web does not talk about their firewall configurations, so I was wondering if changing up the nat table for pre-routing chain was also a necessary step to take in order to administer a MITM attack.
https://www.youtube.com/watch?v=fkYd8MPzgts Question about this example video: How in the world did the attacker sniffed the dns packet using scapy just by filtering tcp port 80. Since in the video the attacker did not show any firewall (iptables) configurations, I assumed that all of the victim's traffic including DNS query packets were all sent to the attacker, then how did the victim obtain connection with google and twitter if the attacker didn't forward the traffic to the gateway/victim?
Can someone please explain? Thank you in advance.