Jump to content

Configuring OpenVPN tunnel to server for extended MITM: Tun? Tap?


Recommended Posts

I'm trying to set up a VPN tunnel for all traffic connected to the Pineapple in client mode, with the tunnel endpoint being my Ubuntu VPS out in the cloud. The goal here is to provide internet access to all clients connected to the Pineapple, while enabling more powerful MitM attacks like Metasploit using my VPS.

I've installed OpenVPN on both my server and Pineapple and set up their respective keys, but I am at a loss now as to the proper configuration. Tun? Tap? Br0? lo? Should I be using tap0 or tun0 for each side of the tunnel? (And how does it hook into the pineapple's traffic?)

Could someone kindly sketch out the ideal configs for this kind of setup?

In an earlier post, Sebkinne referred a user to this "howto", which specifies the client [=pineapple] as tap0.

Forgive my ignorance, but don't you want to make the OpenVPN client side [=pineapple] "tun0" and the OpenVPN tunnel's endpoint on the ubuntu server "tap0"? (Which in turn redirects internet traffic to its internet-facing eth0 interface?)

I'm lost. In advance, thank very much for any help you can offer.

Edited by fanbase
Link to post
Share on other sites

In short the difference between tap and tun.

Tun:

This will create a seperate network(subnet) and you need to configure your device as a router to use it. What this means is that all broadcast traffic and special traffic like dhcp request will end at this point.

Tap:

This will create a extended network(same subnet) and you need to configure your device as a bridge to use it. What this means is that you can allow all traffic to pass over this device to the other side of the network.

Now you can use this mixed. Say you put a tap tunnel on your pineapple and a tun device on your VPS. This way you can get all the traffic of the pineapple clients towards your VPS. While your vps can play as a router and do dhcp,dns, firewalling, redirects, ... and all the other stuff.

If you want more info about this. Check the openvpn website.

Link to post
Share on other sites

Thanks for your reply, GuardMoony, but your answer seems at odds with the OpenVPN website:

Now you can use this mixed. Say you put a tap tunnel on your pineapple and a tun device on your VPS. This way you can get all the traffic of the pineapple clients towards your VPS. While your vps can play as a router and do dhcp,dns, firewalling, redirects, ... and all the other stuff.

If you want more info about this. Check the openvpn website.

Really? The OpenVPN website seems pretty emphatic that you can't mix tap and tun, as do the comments in the config files:

Absolute NO - TUN & TAP Cannot be mixed.

https://forums.openvpn.net/topic14913.html

You cannot mix --dev tun and --dev tap on different ends of the connection. Use one or the other consistently.

Is there something I'm not getting?

Edited by fanbase
Link to post
Share on other sites

TAP is for layer 2, TUN is for layer 3. It sounds like you want tap, since that will give you layer2 visibility all the way through the tunnel. Then you may be able to play arp games and such, assuming the tap driver doesn't stop you. That will be a little more flexible. This needs to be the same on both sides (the openvpn client and server).

Your gateway IP will end up on the TAP interface on your server (or on some interface that your TAP is bridged to).

Once you have your connection up, it sounds like you want to bridge the wlan interface to the tap interface on your pineapple. This should be reasonably easily done since it looks like the bridge tools are included (brctl).

Check out this page for more details on the openvpn side. It does not address the bridge.: http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

http://www.dd-wrt.com/wiki/index.php/Brctl_command

Edited by wifi-stuff
Link to post
Share on other sites

Like Wifi-stuff said. To have all the need stuff use tap ( layer 2 ).

It's also better if do the setup yourself. That way at least you learn how it works, and it something goes wrong later you know what the problem could be. All the info you need, you can find in the 3 guides posted on this thread:

http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

http://www.dd-wrt.com/wiki/index.php/Brctl_command

http://wiki.openwrt.org/doc/howto/vpn.client.openvpn.tap

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...