Exercise 5-5: Mid course project – “Kali Pi” Access Point

This will require a few things:

• Raspberry Pi 3. You can use an older model with a USB wifi but you’re on your own when it comes to configuring wlan0.
• hostapd: This creates an access point
• dnsmasq: This does DNS forwarding and provides a DHCP sever
• dhcpcd5: A DHCP client (which also does other cool network management stuff)

Grab the required packages:

First, let’s tell dhcpcd to ignore wlan0’s setup. We’ll configure a static IP later:

Put this above any interface lines that may be in the file:

Now, let’s set up our wifi interface. If you have a Pi 2 with a USB wi-fi adapter, go ahead and plug it in now. Edit the interfaces file:

…and add this section:

Restart dhcpcd with:

and then reload the configuration for wlan0 with:

Next, let’s configure hostapd with a new configuration file. Note that an SSID and passphrase are configured for your access point.

At this point, we can test things out. Run:

 

This shows a successful run. Note that the errors pertaining to monitor mode are not relevant to us. For a RPi3 using the nexmon firmware, we would need (or an app) should nexutil -m2.

You can connect to this access point and hostapd will show some output:

 

And once you enter the passphrase you should see something like this:

 

Note that your client may disconnect and reconnect because it didn’t get an IP address. This is normal. You won’t get an IP address until we configure dnsmasq. Have fun with this! It gives you an idea of how this process works, behind the scenes.

Press Ctrl-C to stop hostapd.

Next, we’ll tell hostapd where to find its config file:

..Find the line #DAEMON_CONF=”” and replace it with DAEMON_CONF=”/etc/hostapd/hostapd.conf”

Let’s get dnsmasq set up:

The file should look like this:

Now, we have two interfaces active, and we have a DHCP client for our Pi and a DHCP server for our wireless guests. Now we need to forward traffic between the wifi and ethernet interfaces. We can make this happen immediately with a simple command to update /proc:

However, this change won’t stick between reboots. We need to make it permanent through sysctl:

..uncomment the line containing net.ipv4.ip_forward=1:

The forward isn’t quite enough to give our wifi guests Internet access (through our eth0 interface). We need iptables to help us do this.

Let’s unwrap these commands:

1. Whenever a new connection is encountered (-t nat), we want to alter the packets as they are about to go out (-A POSTROUTING) on our ethernet interface (-o eth0). The -j MASQUERADE target masks the private IP address of the client with the external IP address of the firewall/gateway (Kali Pi).
2. Next, we append (-A) a rule to the FORWARD chain (packets being routed through the Pi) which accepts (-j ACCEPT) packets from eth0 to wlan0 (-i eth0 -o wlan0) that belong to (ESTABLISHED) or are related to (RELATED) an existing connection.
3. Lastly, we will forward (and accept) all packets from wlan0 to eth0.

Check out our rules:

Output our rules to a file:

Apply these rules every time we boot the Pi by editing the /etc/rc.local file:

Make the file executable:

As we’ve seen, hostapd and dnsmasq ship with all the init system goodies (see /etc/init.d), so let’s start the services up and check that they are happy:

 

And let’s set them to run on next reboot:

 

Finally, reboot and make sure the rules stick after a reboot. Once rebooted, you should be able to connect to the “Kali Pi” and surf!