I am working on a network security project that can inspect network traffic before forwarding and accepting traffic from the internet.
I have a R-Pi B+ Model running raspbian stretch lite where the in-built NIC is connected to my ISP router and i also have a wireless USB adapter to create a wireless network where clients can connect to. (Used hostapd and isc-dhcp-server for this). I used this tutorial to set up the R-Pi as a wireless AP https://learn.adafruit.com/setting-up-a-raspberry-pi-as-a-wifi-access-point?view=all
Here is what my set up looks like:
Smartphone(192.168.42.10) ---> wlan0(192.168.42.1) ---> R-Pi---> eth0(192.168.0.17) ---> ISP Router(192.168.0.1) ---> Internet
My ip route command looks like this:
default via 192.168.0.1 dev eth0 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.17 192.168.42.0/24 dev wlan0 proto kernel scope link src 192.168.42.1
When i run traceroute, it shows that packets are first sent to the R-Pi before it goes to my ISP route which is of course expected.
Tracing route to one.one.one.one [126.96.36.199] over a maximum of 30 hops: 1 1 ms 1 ms 1 ms 192.168.42.1 2 1 ms 1 ms 1 ms 192.168.0.1
For instance, i tried blocking 188.8.131.52 (facebook.com) on all the iptables chains, but nothing is being blocked. I can still ping/browse from client machines. Here is what my iptables look like
Chain INPUT (policy ACCEPT 1355 packets, 104K bytes) num pkts bytes target prot opt in out source destination 1 0 0 DROP all -- * * 184.108.40.206 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 5352 5413K ACCEPT all -- eth0 wlan0 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 3346 650K ACCEPT all -- wlan0 eth0 0.0.0.0/0 0.0.0.0/0 3 0 0 DROP all -- * * 220.127.116.11 0.0.0.0/0 4 0 0 DROP all -- * * 0.0.0.0/0 18.104.22.168 Chain OUTPUT (policy ACCEPT 1013 packets, 139K bytes) num pkts bytes target prot opt in out source destination 1 0 0 DROP all -- * * 0.0.0.0/0 22.214.171.124