I am trying to setup a test environment for research/reverse engineering of wireless platforms.
I have a router AP broadcasting my network which the hardware I am researching connects to, and from there the AP will redirect all traffic to a server for analyzing.
My iptables nat rules on the AP for redirecting traffic are:
iptables -t nat -A PREROUTING -p tcp --dport 80 -m conntrack --ctstate NEW -j DNAT --to x.x.x.x:8880 iptables -t nat -A PREROUTING -p tcp --dport 443 -m conntrack --ctstate NEW -j DNAT --to x.x.x.x:8443 iptables -t nat -A PREROUTING -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A POSTROUTING -t nat -j MASQUERADE
Both the AP and the server have IP_FORWARD enabled as well.
And on my server I have software such as sslsplit, mitmproxy or others that take the traffic and allows me to analyze it.
The problem is, when I redirect traffic in this way, the software on my server keeps wanting to connect to itself for some reason rather than connect to the proper port/domain.
For example if my server IP was 126.96.36.199:8443; when the hardware, 192.168.0.100, connected to my AP accesses a website which resolves to 188.8.131.52:443 the iptables rules redirect all my traffic going to 184.108.40.206:443 to 220.127.116.11:8443 for analyzing. That's all good, but when the software tries to forward the connection to the remote http server to finish the request/get a response, instead of passing the traffic to 18.104.22.168:443 for a response it sends it to 22.214.171.124:8443 (aka itself).
Is this the fault of my iptables rules or some kind of software problem? The same results happen for a handful of software when used in his remote processing fashion so I am lead to believe it is a problem with how I am redirecting the traffic.
Is traffic redirection like this possible or does this have to be done another way?
The setup is client (192.168.0.100) -> AP -> router -> internet -> data processing server (126.96.36.199:8443) -> internet -> web host (188.8.131.52:443)
Any suggestions will be appreciated.