1

I have been trying to set up a fake AP for testing purposes. I was successfully able to get airbase-ng working and set up a DHCP server for the clients to obtain IP address, which all works. My laptop has an external wifi card for the AP and a internal for internet. However, when I startup the AP, the clients (my phone) cannot perform web browser searches and neither can my laptop, even though the laptop has a second wifi card not in monitor mode.

Here is my configuration:

sudo ifconfig wlan1 down
sudo ifconfig wlan1 up
sudo airbase-ng -c 11 -e ANET wlan1



sudo ifconfig at0 192.168.1.1 netmask 255.255.255.0
sudo ifconfig at0 mtu 1800
sudo route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1
sudo iptables -P FORWARD ACCEPT
sudo iptables --append FORWARD --in-interface at0 -j ACCEPT
sudo iptables --table nat --append POSTROUTING --out-interface wlan0 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
sudo dhcpd -cf /etc/dhcp/dhcpd.conf -pf /var/run/dhcpd.pid at0
sudo /etc/init.d/isc-dhcp-server start

ip_forwarding is enabled.

This is from a tutorial. Then I run sslstrip and ettercap.

This is my DHCP subnet configuration

Authoritative;
Default-lease-time 600;
Max-lease-time 7200;
Subnet 192.168.1.0 netmask 255.255.255.0{
option routers 192.168.2.1;
option subnet-mask 255.255.255.0;
option domain-name "ANET";
option domain-name-servers 192.168.1.170;
range 192.168.1.2 192.168.1.40;
}

The dhcpd command responds with:

Multiple interfaces match the same subnet: wlan0 wlan1
Multiple interfaces match the same shared network: wlan0 wlan1
Multiple interfaces match the same subnet: wlan0 at0
Multiple interfaces match the same shared network: wlan0 at0
Multiple interfaces match the same subnet: wlan0 wlan1
Multiple interfaces match the same shared network: wlan0 wlan1
Multiple interfaces match the same subnet: wlan0 at0
Multiple interfaces match the same shared network: wlan0 at0
Multiple interfaces match the same subnet: wlan0 at0
Multiple interfaces match the same shared network: wlan0 at0

ettercap shows the DHCP request and ack from the client:

DHCP: [192.168.1.1] OFFER : 192.168.1.2 255.255.255.0 GW 192.168.1.1 DNS 192.168.1.1 "ANET"
DHCP: [192.168.1.1] OFFER : 192.168.1.2 255.255.255.0 GW 192.168.1.1 DNS 192.168.1.1 "ANET"
DHCP: [C0:BD:D1:15:2B:64] REQUEST 192.168.1.2
DHCP: [192.168.1.1] ACK : 192.168.1.2 255.255.255.0 GW 192.168.1.1 DNS 192.168.1.1 "ANET"
DHCP: [192.168.1.1] ACK : 192.168.1.2 255.255.255.0 GW 192.168.1.1 DNS 192.168.1.1 "ANET"

My IP address on wlan0 is 192.168.1.170.

Edits:

DHCP config:

        Authoritative;
    Default-lease-time 600;
    Max-lease-time 7200;
    Subnet 192.168.2.0 netmask 255.255.255.0{
    option routers 192.168.2.1;
    option subnet-mask 255.255.255.0;
    option domain-name "ANET";
    option domain-name-servers 192.168.1.170;
    range 192.168.2.2 192.168.2.40;
}

Iptables:

sudo ifconfig at0 192.168.2.1 netmask 255.255.255.0
sudo ifconfig at0 mtu 1800
sudo route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.2.1
sudo iptables -P FORWARD ACCEPT
sudo iptables --append FORWARD --in-interface at0 -j ACCEPT
sudo iptables --table nat --append POSTROUTING --out-interface wlan0 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
sudo dhcpd -cf /etc/dhcp/dhcpd.conf -pf /var/run/dhcpd.pid at0
sudo /etc/init.d/isc-dhcp-server start
sudo sslstrip -f -p -k 10000
9
  • Do you have forwarding turned on in your kernel? May 28, 2015 at 18:55
  • I forgot got to add that to my question. Yes I do. I edited ip_forwarding to "1" manually that's why it's not there under my configuration
    – dylan7
    May 28, 2015 at 18:56
  • What is the DHCP server telling the clients to use as their default gateway? What is the subnet on the upstream side of your laptop?
    – Spiff
    May 28, 2015 at 19:51
  • @Spiff: I added more information to my question. Let me know if I did not add something you asked.
    – dylan7
    May 28, 2015 at 20:03
  • @dylan7 I was mainly looking for your DHCP subnet configuration. Please add what your IP address/subnet on wlan0 is. Also, your DHCP server on your laptop is telling your "fake AP" clients to use your laptop as their DNS server; so is your laptop running a DNS proxy or DNS recursive/resolving server of some kind?
    – Spiff
    May 28, 2015 at 20:10

2 Answers 2

2

You've documented two problems so far:

  1. You've got the same IP subnet on both sides of your laptop. Your laptop is acting as a NAT gateway which is kind of like an IP router on steroids. IP routers need to have different subnets on each side, otherwise they don't know how to route things.

  2. You've configured your DHCP server to tell your softAP's clients to use your laptop as their DNS server, but your laptop isn't configured to act as a DNS server or proxy.

You could fix this by changing your subnet for your softAP clients to 192.168.2.0/24, but keep your DHCP server process telling the clients to use 192.168.1.1 as your DNS server. That way their DNS requests will go through your laptop NAT to your upstream NAT gateway, which probably does have a DNS proxy service running on it.

2
  • I put up the edits I made. It resolved the error that DHCP was giving me. However, the clients still can't connect to the internet. For DNS I tried 198.168.1.1 and 198.168.1.170 (wlan0). 198.168.1.1 was the original IP of at0 the fakeAP but it changed to 192.168.2.1 after changing the subnet.
    – dylan7
    May 28, 2015 at 23:55
  • @dylan7 What DNS server addresses do you usually use on your laptop? I assumed that since your laptop is at 192.168.1.170, it's probably talking to an upstream NAT gateway at 192.168.1.1, and most home NAT gateways run a DNS proxy on their LAN (NAT private) IP address. You need to tell your clients to use a DNS server address that you know works. I can't tell you what DNS server address is correct for your network.
    – Spiff
    May 29, 2015 at 0:08
0

To fix this. I followed Spiff's answer and tried a few other things that made it work in the end.

1) I changed the IP subnet in the DHCP configuration file to 192.168.2.0/24 as Spiff said to do.

2) I made the gateway in the iptables and the option routers in the DHCP configuration file to 192.168.2.1

3) Last piece: I changed the DNS to Google's 8.8.8.8 in the DHCP configuration file. My AP may have been blocking the ability to use it as DNS...just a guess

1
  • Thanks for closing the loop on your question. Can you expand your answer to provide more explanation for others who have a similar problem to help them understand the solution?
    – fixer1234
    Jun 3, 2015 at 1:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .