0

I have an OpenWRT router (192.168.1.1) with various wired and wireless clients (192.168.1.x).

One of the clients is a Suricata Sensor (192.168.1.100) with only one, 1000MBbit NIC.

I want to reroute all traffic of the OpenWRT router through this Suricata client.

How do I do this with iptables?

user3200534
  • 302
  • 1
  • 3
  • 10

1 Answers1

0

In order to route wireless traffic to a single client that is not the router you can ARP poison your own network and make all wireless clients believe your Suriccata box is the gateway, and then you can route traffic to the actual gateway from your sensor. It would basically act like a middle-man.

This is far too tedious and your sensor will likely crash under all the stress from logging and routing all that traffic. What you can do, and what I did, is to set up an access point (I created one from a Raspberry Pi 2 and a USB wifi adapter), and wire that access point directly to your sensor and wire your sensor directly to the router. Otherwise, your sensor cannot actually detect/filter/modify traffic moving to and from the router if it does not lie directly in between the router and the wireless clients.

Here is a link to get you started: http://www.glennklockwood.com/sysadmin-howtos/rpi-wifi-island.html

Ken Ali
  • 1