0

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port)

[internet]----(eth1)[my computer](wlan0 hotspot)
                                         |
                                         |
                                         |
                                   [destination]

how should I setup my iptables rules, that before forwarding packets to hotspot, I could pass them through a proxy server (burp suite for example). Like this:

[internet]----(eth1)[my computer]
                          |
                          |
                          |
                      (:8080)[proxy server](wlan0 hotspot)
                                                 |
                                                 |
                                                 |
                                            [destination]

Also, how should I configure burp suite that it could forward packets to recipient?

  • 1
    The term you're looking for is "transparent proxy". You should have no trouble finding information on how to set one up. – Mark Nov 18 '14 at 7:47
1

If I understand correctly, your computer serves as a Wifi Access Point, so it should have a dhcp server running on wlan0, is that so ?

Assuming this is the case, First you need to have /proc/sys/net/ipv4/ip_forward set to 1 instead of 0 (if you are using IPv4, I don't know the equivalent for IPv6, if there is any)

The iptables command you are looking for is

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE or

iptables -t nat -A POSTROUTING -o eth1 -j SNAT --to-destination <eth1 IPv4 address>

This will masquerade all IP addresses from wifi to one eth1 has and magically redirecting all response packets to the correct device on the wifi network

To use Burp, the simplest thing to do is to configure Burp as a proxy on the wifi devices. If not possible, You need to set two listeners with "Invisible Proxy support" for Burp, one for HTTP (let's say on port 8080) and one for HTTPS (let's say on port 8443). Then the iptables commands will be :

iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-ports 8080 and

iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 443 -j REDIECT --to-ports 8443

If I remember correctly, that should do the trick.

  • The recent versions of iptables doesn't accept the command: iptables v1.6.1: unknown option "--to-destination" The answer looks good otherwise, @aniem, could you please update it to be compatible with current iptables? – Per Christian Henden Feb 3 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.