0

I have a Raspberry Pi physically between my switch and my client. The switch uses 802.1x authentication with an radius server.

If I setup my Raspberry in transparent bridging mode everything works fine. I can authenticate my client with the router and access the Internet.

But now I want to have access with the raspberry as well, impersonating the client.

Therefore I gave my bridge an IP (192.254.66.66), added the route for my network 192.168.x.0/24 and added the default gateway 192.168.x.254.

I also added ebtable and iptable entries to SNAT the outgoing traffic to appear to be from the client:

ebtables -t nat -A POSTROUTING -s (Mac from eth0) -o eth0 -j snat --to-src (Mac from my client)

iptables -t nat -A POSTROUTING -o br0 -s 192.254.66.66 -p tcp -j SNAT --to (IP from my client 192.168.x.17 with high, mostly unused ports)

iptables -t nat -A POSTROUTING -o br0 -s 192.254.66.66 -p udp -j SNAT --to (IP from my client 192.168.x.17 with high, mostly unused ports)

iptables -t nat -A POSTROUTING -o br0 -s 192.254.66.66 -p icmp -j SNAT --to (IP from my client 192.168.x.17)

If I try to ping google.com I get an error: ping: unkown host google.com

If I try to ping my gateway 192.168.x.254 I can see the ECMP echo request and replies in tcpdump, but they are (of course) addressed to 192.168.x.17 and therefore my Raspberry isn't realizing the answer is for him. Shouldnt iptables track the connection and decide to either forward the packets if they come from the client or take them if they come from the bridge?

1
  • Unfortunately, questions about "bypassing network security or policies" are explicitly off-topic here.
    – Ron Maupin
    May 23 '16 at 2:06
1

I expect you need to use the redirect target in ebtables to pull the packets out of the bridge and into IP routing so that the NAT machinary can see them.

But I haven't actually tried it so I don't know if it will work or what if any gotchas there are.

Not the answer you're looking for? Browse other questions tagged or ask your own question.