Search code examples
ubuntunetwork-programmingiptables

Reroute traffic through virtual machine with one interface

I want to experiment with networking stuffs and I'm trying to configure test environment for some exercises with traffic sniffing and I want to reroute all the traffic from 1st VM (A) through the 2nd VM (B) but with one interface. Something like Man In The Middle but with normal ip, iptables commands. Both machines are VirtualBox Ubuntu 18.04.

First, I've created topology like this: VM A - interface (internal network) VM B - interface (internal network enp0s8), interface (NAT enp0s3)

With commands on VM B:

sysctl net.ipv4.conf.all.forwarding=1
sysctl net.ipv6.conf.all.forwarding=1
iptables -A FORWARD -i enp0s8 -o enp0s3 -j ACCEPT
iptables -A FORWARD -i enp0s3 -o enp0s8 -j ACCEPT
iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE

and commands on VM A:

ip route add default via <VM_B_ip>

but then I started to wonder if there is more elegant solution for this. (More elegant == 1 interface instead of 2). I wrote myself these 3 goals that I think will be correct to do this:

(VM A and VM B are configured in Host-Only network)

  1. Change default route on VM A like in the previous solution (Know how to do it)
  2. On VM B - forward traffic from VM A to Host (but in a way to distinguish VM A's traffic from VM B)
  3. On VM B - forward traffic from Host to VM A (but again, what's the best way to distinguish traffic, with ports maybe?)

I will be very thankful for any kind of advice. Especially if someone could tell if my way of thinking (these 3 points) is correct.

Solution

  • I don't think there is a more elegant solution than the nat-interface-approach.

    You could try to configure VM-A to have VM-B as default gateway and your host (workstation?) to have VM-B as gateway into your network. Now you would have to create firewall rules, that broadcasts are blocked that your vm-a can't resolve your workstation and make direct connections.

    So the approach with a "internal net" and VM-B as a NAT to the host needs two network-interfaces, but is definitily much less work and I'm not even sure if your approach with one net-interface would really work.