1

Situation
There's a intranet with access to the internet. However, you can only gain access to this network, and therefore the internet, if your device has a whitelisted MAC address. This is no problem though, as you can easily use a MAC changer to bypass this barrier by using one of the already whitelisted addresses.

Goal
As this network is only accessable through a wired connection, a Raspberry Pi shall be used to make a wireless connection available. Thus the RPi needs to be connected to the mentioned network and is supposed to work as a WLAN access point.

RPi configuration
The RPi (3 Model B) is running Raspbian as OS. To create the AP, I'm using hostapd. And to for the DNS and the DHCP stuff, I'm using dnsmasq.
I won't list all the steps I did to get a working configuration, but if you want to get an idea of it, I used the following (here and here) tutorials (they're in German, but at least, you can see the used commands, sorry).
However, the current configuration seems to be correct to some extend, as I can successfully use it at home without any issues.

Problem
Altough I'm able to connect to the RPi with my laptop or my smartphone, I have no internet connection.
Connected to the RPi via SSH (using PuTTY), there's no answer when pinging google.com (or 8.8.8.8).

Things that are working and possible solutions
First of all, I got this setup (with a slightly different configuration I'm not aware of anymore, damn it) working once. Also I'm able to connect to the network and the internet with a spoofed MAC using my laptop. The accessablility of websites varies using different browsers though (best one seems to be IE/Edge).

Things that are already working:

  • RPi (eth0) gets an IP address.
  • One can connect to the AP with his/her smartphone.
  • google.com gets resolved to an IP (172.217.21.110 for example).
  • The spoofed MAC address is used to send data packages (observed with tshark).

Possible solutions that didn't work out/solve the problem:

  • Configuring the correct time on the RPi.
  • Pinging an IP instead of a domain (in case of a failing DNS resolution).
  • Changed the MAC of eth0 (RPi's wired connection) to several different whitelisted ones (using macchanger and /etc/network/interfaces).
  • Used different ethernet ports to connect to the given network.
  • Changing the configuration file of dnsmasq (i.e. server, dhcp-option, etc.).
  • Setting up a the whole system (and configuration) a second time (not on purpose, happend due to a failing SD card) (The first setup was installed through the NOOBS setup while the second one was installed via the lite version of Raspbian).

EDIT
Stupid as I am, I never actually took a look into /var/log/syslog.
While going through it, I found that often there's a reply from dnsmasq looking like this: reply geo-prod.do.dsp.mp.microsoft.com is <CNAME> after wlan0 is activated and working.
May the rest of the log help to solve this issue.


To me the whole situation just seems kind of weird right now, because every single part of the whole thing is working, just not as one system. (The current configuration is working at home and I have access to the network and the internet with a spoofed MAC address using my laptop).
I hope, anybody of you can help me out with this one, as I have no more ideas left how to get this working. Maybe someone of you has ran into any kind of similar issue once.
What may be configured badly in my case? Do I miss something? Is there any plausible explanation why it worked once and now, without any major changes, doesn't?
I greatly appreciate your help!


In case I missed any detail about the situation/configuration that's necessary to solve this problem, just ask me in the comments.

2

Did you enable IP forwarding? Try this:

sudo tee << EOF /proc/sys/net/ipv4/ip_forward > /dev/null
1
EOF

If it works, edit /etc/sysctl.conf to include this line, then reboot:

net.ipv4.ip_forward=1
1

It is possible that the device that originally owns the MAC address you are spoofing is active on the network at the same time you are. I would scan the network to make sure the coast is clear, and switch to a different whitelisted MAC address that currently is not in use. sudo nmap -sP 192.168.178.1/24 (or whatever IP range the LAN is using) will list IP addresses, MAC addresses and hostnames currently connected to the scanned network. There may also be other security policies in place on that LAN.

  • I thought of that as well, but the corresponding client with the spoofed MAC address was not active while testing, so that's most likely not the case. – Daniel May 29 '16 at 18:21
1

You should add this line to /etc/network/interfaces as well to make NAT work:

up iptables-restore < /etc/iptables.ipv4.nat

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.