I've been trying to ARP poison my home computer and router (intended to learn and discover the networks behavior). And with success. The whole time I've been using:
with open('/proc/sys/net/ipv4/ip_forward', 'w') as ipf: ipf.write('1\n')
To enable port forwarding. Now I was trying to drop or accept packets, based upon their source and destination IP:
iptables -I FORWARD -s " + HostA.IP + " -d " + Router.IP + " -i wlan0 -j DROP
This code should drop all packets from host A, according to this scheme:
Poisoned Host A --X---->Me----X---->Router <------- <---------
However, packets from host A still reach the router, thus the IPtable rule does not work. My best bet is that the packet originating from host A has the router's IP as destination IP, but my MAC address as hardware destination (it's ARP tables are poisoned ...). Could this influence the " -d " + Router.IP and cause the IPtables to accept it and port forward it (ip_forward is still set to 1, and yes I've tried to set it to 0).
Any suggestion to make this work (preferably a working IPtable rule)? I am using Bracktrack 5 r3 Linux, coding in Python.