0

Good Evening,

I am trying to set up a man-in-the-middle scenario by creating an unencrypted access point and routing the traffic to my local router at home. To do so I did the following steps:

Step 1: Adjusting dhcp.conf file like this:

subnet 192.133.1.0 netmask 255.255.255.0 {
default-lease-time 600;
max-lease-time 7200;
option routers 192.133.1.1;
option broadcast-address 192.133.1.255;
option domain-name "man-in-the-middle-demo";
range 192.133.1.10 192.133.1.50;
}

Note: Airbase-ng creates a tunnel interface called at0.

Step 2: Configuring at0:

sudo ip link set at0 up
sudo ip addr add 192.133.1.1/24 dev at0

Step 3: Setting the interface of my dhcp-server by editing /etc/default/isc-dhcp-server like this:

INTERFACESv4="at0"

Step 4: Adding this route to the route table:

sudo route add -net 192.133.1.0 netmask 255.255.255.0 gw 192.133.1.1

Step 5: Activating ip-forwarding:

echo 1 > /proc/sys/net/ipv4/ip_forward

Step 6: Changing the destination from packages to my routers ip:

sudo iptables -t nat -A PREROUTING -j DNAT --to-destination 192.168.178.1

Step 7: Masquerade the packages with my ip and specify output interface:

sudo iptables -t nat -A POSTROUTING -o enp4s0 -j MASQUERADE

Step 8: I don't understand why I have to do this but I have seen it in a tutorial. Please explain.

sudo iptables -P FORWARD ACCEPT
sudo iptables -A FORWARD --in-interface at0 -j ACCEPT

file Step 9: Finally run DHCP-server like this:

sudo dhcpd -cf /etc/dhcpd/dhcpd.conf at0
sudo bash /etc/init.d/isc-dhcp-server start

When I run sudo /etc/init.d/isc-dhcp-server status I get this message:

● isc-dhcp-server.service - ISC DHCP IPv4 server
   Loaded: loaded (/lib/systemd/system/isc-dhcp-server.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2019-11-27 21:23:37 CET; 6s ago
     Docs: man:dhcpd(8)
 Main PID: 6779 (dhcpd)
    Tasks: 1 (limit: 4915)
   CGroup: /system.slice/isc-dhcp-server.service
           └─6779 dhcpd -user dhcpd -group dhcpd -f -4 -pf /run/dhcp-server/dhcpd.pid -cf /etc/dhcp/dhcpd.conf

Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]: 
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]: 
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]: **No subnet declaration for enp4s0** (192.168.178.29).
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]: ** Ignoring requests on enp4s0.  If this is not what
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]:    you want, please write a subnet declaration
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]:    in your dhcpd.conf file for the network segment
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]:    to which interface enp4s0 is attached. **
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]: 
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]: Sending on   Socket/fallback/fallback-net
Nov 27 21:23:37 astudent-ThinkPad-E490 dhcpd[6779]: Server starting service.

Also note the message on the right saying that my dhcp-server is ignoring subnet requests on enp4s0. Can someone explain what that means?

If I connect to the AP I get an ip-address but I cannot reach websites. I also do not understand how iptables works in detail. I guess I need some help here...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.