0

I am trying to setup a test environment for research/reverse engineering of wireless platforms.

I have a router AP broadcasting my network which the hardware I am researching connects to, and from there the AP will redirect all traffic to a server for analyzing.

My iptables nat rules on the AP for redirecting traffic are:

iptables -t nat -A PREROUTING -p tcp --dport 80 -m conntrack --ctstate NEW -j DNAT --to x.x.x.x:8880
iptables -t nat -A PREROUTING -p tcp --dport 443 -m conntrack --ctstate NEW -j DNAT --to x.x.x.x:8443
iptables -t nat -A PREROUTING -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -j MASQUERADE

Both the AP and the server have IP_FORWARD enabled as well.

And on my server I have software such as sslsplit, mitmproxy or others that take the traffic and allows me to analyze it.

The problem is, when I redirect traffic in this way, the software on my server keeps wanting to connect to itself for some reason rather than connect to the proper port/domain.

For example if my server IP was 1.1.1.1:8443; when the hardware, 192.168.0.100, connected to my AP accesses a website which resolves to 2.2.2.2:443 the iptables rules redirect all my traffic going to 2.2.2.2:443 to 1.1.1.1:8443 for analyzing. That's all good, but when the software tries to forward the connection to the remote http server to finish the request/get a response, instead of passing the traffic to 2.2.2.2:443 for a response it sends it to 1.1.1.1:8443 (aka itself).

Is this the fault of my iptables rules or some kind of software problem? The same results happen for a handful of software when used in his remote processing fashion so I am lead to believe it is a problem with how I am redirecting the traffic.

Is traffic redirection like this possible or does this have to be done another way?

The setup is client (192.168.0.100) -> AP -> router -> internet -> data processing server (1.1.1.1:8443) -> internet -> web host (2.2.2.2:443)

Any suggestions will be appreciated.

0

Does the traffic from your server to 2.2.2.2:443 (the original destination) traverse the AP?

In that case the translation would apply, so change your DNAT rules so that traffic originating from the server is excluded from the DNAT translation.

iptables -t nat -A PREROUTING -p tcp ! -s x.x.x.x --dport 80 -m conntrack --ctstate NEW -j DNAT --to x.x.x.x:8880
  • I'm not quite sure what you mean by transverse, but the setup is client (192.168.0.100) -> AP -> router -> internet -> data processing server (1.1.1.1:8443) -> internet -> web host (2.2.2.2:443) The data processing server I am redirecting traffic to is not on the LAN of where the client/AP is, but rather a datacenter, if that effects anything. I will try your nat rule though and see if it changes anything. – user283167 Jun 18 '15 at 23:31
  • Before your description of the setup I thougt everything was local. As this is not true, my suggested change should have no effect. Ignore it – Silvio Massina Jun 19 '15 at 0:02
  • Would setting up a vpn connection be easier for forwarding this data to another network/server be easier than using iptables? – user283167 Jun 19 '15 at 0:14
  • I don't think the VPN would be easier (but I know just part of the whole picture) – Silvio Massina Jun 19 '15 at 0:30
  • How did you see the incorrect behaviuor of the server side? Tcpdump? Logs? – Silvio Massina Jun 19 '15 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.