Iptables and ip spoofing?

Question

linux

Good day, Habr!
No one will tell you how to implement ip substitution using iptables? And then I set the binding by ip and now I need to somehow solve the problem.
The essence of the task is this: there is a router and a computer behind the router, you need to connect to it from outside so that the computer on the other side of the router thinks that the connection came from the local ip. My computer is not connected to the router in any way, access to the router is only remote.

Answer 1

Well, I managed to do this. I'm telling.
Let's say we have a LAN that gets Internet access through a router.
The router has two interfaces:

• eth0 - Internet, has the address 192.0.2.55/24 (this address was issued by the provider, the provider has a gateway 192.0.2.1)
  
• eth1 - locale, has the address 192.168.1.1/24 (this was the default. They did not change.) - gray
  

The router does address translation (only it has a white address). It has routes:

192.168.1.0/24 dev eth1 src 192.168.1.1
192.0.2.0/24 dev eth0 src 192.0.2.55
default via 192.0.2.1

and one translation rule (this is all that is needed for the Internet to appear in the local area): either

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

either way

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 192.0.2.55

There is a computer in the local area, say, with the address

192.168.1.22/24

and routes

192.168.1.0/24 dev eth0 src 192.168.1.22
default via 192.168.1.1

and the internet works on it.
We want to connect to the computer from the address 192.0.2.66 (from the outside) so that the computer thinks we are actually connecting from 192.168.1.77.
On the router, add the destination broadcast:

iptables -t nat -A PREROUTING -s 192.0.2.66 -i eth0 -j DNAT --to-destination 192.168.1.22

to wrap all packets from the desired address to the computer (and they were sent to the router, which is not needed)

iptables -t filter -A FORWARD -s 192.0.2.66 -d 192.168.1.22 -j ACCEPT

to allow the passage of all such packets

iptables -t nat -A POSTROUTING -s 192.0.2.66 -j SNAT --to-source 192.168.1.77

to replace the source address in packets with a fake one.
From the computer's point of view, 192.168.1.77 is in LAN, it doesn't need a router to send a packet there. Therefore, we will not see the answers - everything will end up with the computer receiving a welcome packet from the outside with the addresses we need and will start looking (arp who-has) to which physical address to send answers. Since there is no such physical address, no one will answer him.
There are two ways to solve this problem. Or you can assign this address to the router: (on the router)

ip addr add 192.168.1.77/24 dev eth1

Now the router has two addresses. When the computer is looking for someone to send the answer to, the router will respond. The packet will be picked up by conntrack, reverse address translations will be done and the response will go where it should.
Or you can tell the computer to go specifically to this address through the router: (on the computer)

ip route add 192.168.1.77 via 192.168.1.1

There is also a radical solution. Let the fake address be in another network, not in the local area: 192.168.2.77/24; then no additional problems will have to be solved, and the argument in the last --to-source will simply change on the router.

Answer 2

Let's say that the router has 2 interfaces of the following form:
eth0 - Internet, has the address **** / 24 - it doesn't matter
eth1 - local, has the address 192.168.1.1/24
The remote computer has the address 1.2.3.4 The
local computer has the address 192.168.1.22
Local the virtual computer has the address 192.168.1.77
First, you need to add an additional address to eth1, which will serve the router:
ip addr add 192.168.1.77/24 dev eth1
or
ifconfig eth1 add 192.168.1.77
Routing from remote to local:
iptables -t nat -A PREROUTING -s 1.2.3.4 -i eth0 -j DNAT --to-destination 192.168.1.22
iptables -t filter -A FORWARD -s 1.2.3.4 -d 192.168.1.22 -j ACCEPT
iptables -t nat -A POSTROUTING -s 1.2.3.4 -j SNAT --to-source 192.168.1.77
Routing to remote from local:
iptables -t nat -A PREROUTING -d 192.168.1.77 -i eth1 -j DNAT --to-destination 1.2.3.4
iptables -t filter -A FORWARD -d 1.2.3.4 -s 192.168.1.22 -j ACCEPT
POSTROUTING - not needed, because there is already NAT configured by the router itself
IMHO, it should so work. If anything - write what errors, we will understand.

Answer 3

As far as I know, this is done by the SNAT (source NAT) function in the prerouting chain of the nat table

Answer 4

Possibly like this:
-A POSTROUTING -d router_IP/32 -j SNAT --to-source REQUIRED_IP

Answer 5

Eh. We'll have to wait a bit. Right now I'm throwing about.

Answer 6

Only the remote computer has a white IP?

Answer 7

Do you have Linux on your router or just a piece of iron with a web interface?