2

I've been trying to ARP poison my home computer and router (intended to learn and discover the networks behavior). And with success. The whole time I've been using:

with open('/proc/sys/net/ipv4/ip_forward', 'w') as ipf:
ipf.write('1\n')

To enable port forwarding. Now I was trying to drop or accept packets, based upon their source and destination IP:

iptables -I FORWARD -s " + HostA.IP + " -d " + Router.IP + " -i wlan0 -j DROP

This code should drop all packets from host A, according to this scheme:

Poisoned Host A --X---->Me----X---->Router

          <-------  <---------

However, packets from host A still reach the router, thus the IPtable rule does not work. My best bet is that the packet originating from host A has the router's IP as destination IP, but my MAC address as hardware destination (it's ARP tables are poisoned ...). Could this influence the " -d " + Router.IP and cause the IPtables to accept it and port forward it (ip_forward is still set to 1, and yes I've tried to set it to 0).

Any suggestion to make this work (preferably a working IPtable rule)? I am using Bracktrack 5 r3 Linux, coding in Python.

Improve this question
6
  • Is this the last rule in iptables? Are all of the packets making it through to the router, or just some? If the latter, which?
    – cremefraiche
    Commented Dec 25, 2014 at 6:47
  • 1
    You're mixing up your layers in this question. Ports are L4, packets and iptables are L3, ARP is L2. If the packet destination IP is the router, I don't know why it would hit the FORWARD table, I would think you would want the INPUT table here, but it's not clear exactly what you're trying to accomplish. Guessing at the problem: the router may be passing your L2 frame with the poisoned MAC up the stack to L3 and respond if it's running in monitor mode. With monitor mode disabled, it should drop the non-broadcast frame before sending it to L3.
    – mgjk
    Commented Dec 25, 2014 at 7:02
  • Excuse me if I wasn't clear: The Problem its not the ARP Packets, they do their job and poison the router and Host A correctly, enabling me to be the man in the middle. My Problem is that I want to control the packet flow from Host A to the router and vica-versa by using the iptables. As Man in the middle the packets weren't destinated for me, but for the router so I figured I had to use the FORWARD chain. After some thinking, I figured that, as a result of ARP poisoning them, Host A and the router had my mac address as destination,so I tried the INPUT chain, but had no luck either way, Thanks
    – LetsCode
    Commented Dec 25, 2014 at 10:47
  • @cremefraiche At first I appended the rule, and later I inserted the rule as first rulenum. I have ARP poisoned Host A and the Router, thus I am the man in the middle, which is correct according to wireshark which shows me packets from Host A, destinated for the Router, passing through my computer. If my port forwarding is on then all the packets make it through the router, and a response it send back to Host A. The rule to drop all packets from Host A should work on all protocols, however it does not drop any packet and all packets are send through to the router
    – LetsCode
    Commented Dec 25, 2014 at 10:55
  • What is the physical topology of your network?
    – Mark
    Commented Dec 26, 2014 at 3:43

1 Answer 1

Reset to default
2

You haven't specified your network setup (how things are wired together), which makes it difficult to figure out what's going on.

Writing "1" to /proc/sys/net/ipv4/ip_forward tells the kernel that your computer is acting as a router: that is, you've got two network interfaces on different subnets, and the kernel should act to pass packets between them. If you genuinely have such a setup, then your iptables rule should work as you expect.

Most likely, your computer is acting as an ordinary host (single network interface on a single subnet), and the packets you are trying to filter never even come near it. In this case, you'll need to re-wire your network so that packets from "host A" pass through it on their way to the router; you'll also need to configure your computer to act as a switch, bridge, or router (your choice, depending on how you want it to handle passing packets between the network interfaces).

Improve this answer
1
  • I have taken a look at wireshark, which showed me packets from Host A destinated for the router and vica-versa, as a result of ARP Poisoning them. Hence, Host A packets do pass through my computer, and arrive at the router. Network Setup: - Attacker Computer running Backtrack r3 - Host A Running Windows 8 - Router: Arcadyan ARV7519i
    – LetsCode
    Commented Dec 25, 2014 at 10:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .