mercredi 24 décembre 2014

ARP: Forwarding or dropping with IPTABLES



So, I ve been trying to ARP Poison my home computer and router (Intended to learn and discover the networks bahaviour). And with success. The whole time I ve been using:



with open('/proc/sys/net/ipv4/ip_forward', 'w') as ipf:
ipf.write('1\n')


To enable Port forwarding. Now I was trying to drop or accept packets, based upon their source and destination IP:




"iptables -I FORWARD -s " + HostA.IP + " -d " + Router.IP + " -i wlan0 -j DROP"


This code should drop all packets from Host A, according to this scheme:


Poisoned Host A --X---->Me----X---->Router



<------- <---------


However, packets from host A still reach the router, thus the IPTABLE rule does not work. My best bet is that the packet originating from Host A has the routers IP as destination IP, but my MAC address as hardware destination (Its ARP Tables are poisoned..). Could this influence the " -d " + Router.IP and cause the IPTABLES to ACCEPT it and port forward it (ip_forward is still set to 1, and yes I've tried to set it to 0).


Any suggestion to make this work (Preferably a working iptable rule)? I am using Bracktrack 5 r3 Linux, coding in Python.


Kind Regards





Aucun commentaire:

Enregistrer un commentaire