I'm doing some experimenting with Kali on my home network and was wondering about something regarding ARP spoofing.
When I ARP spoof another device AND the default gateway, Internet access stops working for said device. To get it working, I must enabled the http & https proxies.
What I'm trying to figure out is why does it break? My understanding of the ARP spoofing process and traffic flow is:
- After succesful arp poisoning, the end device sends constructs its packet destined for a web server living on a public IP address. The frame header shows my device as the target MAC address
- When I receive the frame, it is my understanding that I will simply rewrite the destination MAC address and sent the frame back out the interface
- The gateway will receive the frame and rewrite the IP header (NAT) and send it out to the internet
- When the gateway receives the reply, it consults the NAT translation table and rewrites the destination IP address. Gateway then checks its ARP table and sees me as the target MAC address for the arp poisoned devices IP address
- Gateway writes the frame and my MAC adddress is down as the destination
- I receive the frame, and then rewrite the destination MAC address so it still gets to the original source device
So, with that in mind, i'm struggling to understand at what point external communications break down?