Windows网关下基于WinPcap的数据包重定向技术咨询

Great question! Building a captive portal-style traffic redirect on a Windows gateway involves combining packet capture/modification with traffic blocking. Below are practical approaches tailored to your scenario, starting with the preliminary step of disabling IP forwarding.

Preliminary Step: Disable IP Forwarding on Windows #

First, you need to block the gateway from routing packets to their original destinations. You can do this via two methods:

Using Command Prompt (Admin) #

netsh interface ipv4 set interface "Your Gateway Interface Name" forwarding=disabled

Replace "Your Gateway Interface Name" with the actual name of your network adapter (e.g., "Ethernet" or "Wi-Fi").

Via Registry #

1. Open Registry Editor (regedit.exe)
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
3. Set the IPEnableRouter DWORD value to 0
4. Restart your machine for changes to take effect

Approach 1: WinPcap-Based Packet Manipulation & Injection #

This approach gives you full control over packet headers, allowing you to redirect traffic directly by modifying and re-injecting packets.

Key Steps: #

• Capture Target Packets: Use WinPcap to filter for TCP port 80 (HTTP) packets where the source/destination IP/MAC don't match the gateway's addresses. Use a filter like:

  tcp port 80 and not host <Gateway-IP> and not ether host <Gateway-MAC>
  

• Modify Packet Headers:
  • Change the destination IP to your local HTTP server's IP (e.g., 192.168.1.100 if it's on the gateway machine)
  • Update the destination MAC address to the local server's MAC (or the gateway's own MAC if the server is running on the same machine)
  • Adjust the IP/TCP checksum to reflect the modified headers (critical for the packet to be accepted)
• Inject Modified Packets: Use pcap_sendpacket() to send the altered packet to the local server.
• Handle Server Responses: Capture outgoing responses from your local server, modify the source IP/MAC to match the original destination of the client's request, then inject the response back to the client.

Example Code Snippet (Pseudocode): #

// Open the network adapter
pcap_t* handle = pcap_open_live(adapter_name, BUFSIZ, 1, 1000, errbuf);

// Compile the filter for port 80 traffic
struct bpf_program fp;
char filter_exp[] = "tcp port 80 and not host 192.168.1.1 and not ether host AA:BB:CC:DD:EE:FF";
pcap_compile(handle, &fp, filter_exp, 0, PCAP_NETMASK_UNKNOWN);
pcap_setfilter(handle, &fp);

// Process captured packets
pcap_loop(handle, 0, packet_handler, NULL);

// In packet_handler:
// 1. Parse Ethernet, IP, TCP headers
// 2. Modify dst IP/MAC to local server
// 3. Recalculate checksums
// 4. Send modified packet via pcap_sendpacket(handle, modified_packet, packet_len);

Approach 2: Combine WinPcap with Windows Filtering Platform (WFP) #

For a more efficient and integrated solution, use WFP (Windows' built-in filtering framework) to block/redirect traffic, while WinPcap handles monitoring or logging.

Key Steps: #

• Use WFP to Redirect Traffic:
  • Register a WFP filter on the FWPM_LAYER_ALE_AUTH_CONNECT_V4 layer to intercept outbound TCP port 80 connections.
  • Configure the filter to redirect the connection to your local HTTP server's IP and port (e.g., 127.0.0.1:8080).
• Block Unwanted Traffic: WFP can replace the need for disabling IP forwarding entirely, as you can granularly block only the traffic you want to redirect, allowing other traffic to pass if needed.
• WinPcap for Monitoring: Use WinPcap to log the redirected traffic for auditing or debugging purposes.

Approach 3: Leverage Existing Proxy/Captive Portal Tools #

If you want to avoid low-level packet manipulation, use a transparent proxy setup combined with traffic filtering:

Steps: #

1. Set up a transparent HTTP proxy (e.g., Squid, or a custom Node.js/Python proxy) on your gateway machine.
2. Use WFP or netsh to redirect all outbound port 80 traffic to the proxy's listening port:

   netsh interface portproxy add v4tov4 listenport=80 listenaddress=0.0.0.0 connectport=8080 connectaddress=127.0.0.1
   

3. The proxy will serve your captive portal content instead of forwarding the request to the original destination.

Critical Challenges to Address #

• Bidirectional Traffic: Ensure responses from your local server are rewritten to appear as coming from the original destination IP/MAC to maintain client session consistency.
• Checksum Calculation: When modifying packet headers, always recalculate IP and TCP checksums—invalid checksums will cause packets to be dropped.
• Performance: WinPcap can have overhead under high traffic; WFP is more efficient for filtering/redirecting at the kernel level.
• Session State: Track original client-destination pairs to correctly map redirected responses back to the client.

内容的提问来源于stack exchange，提问作者CodeNinja