ADSL Home Hub NAT Sessions

ADSL Home Hub NAT Sessions

During Covid working from home I can poll my Home hub to check out the NAT sessions.

We wanted t see what connections a Mobile Phone app made during the call.

Looking at NAT Sessions using a Raspberry Pi

I want to see what nodes my Smartphone App connects to.

I do not know how to log onto the Smartphone or the nodes.

I can use the NAT table to see what connections are set up and ripped down.

The new home hub I have does not offer this.

The Raspberry Pi foundation have a really good web page about setting up a Wireless Access point.

https://www.raspberrypi.org/documentation/configuration/wireless/access-point-routed.md

On 04/11/2023 - I find the wesite documentation has been updated for Debian bookworm. This link is for bullseye: https://raspberrytips.com/access-point-setup-raspberry-pi/

I built a bootable memory stick desktop version from https://www.raspberrypi.com/software/raspberry-pi-desktop/ which at the time was Buster

  pi@raspberrypi:/etc $ cat  /etc/os-release
  PRETTY_NAME="Debian GNU/Linux 10 (buster)"

I saved https://www.raspberrypi.org/documentation/configuration/wireless/access-point-routed.md on the desktop and backed this up here:- http://www.dougrice.plus.com/dev/WirelessAccessPoint.zip od see this: https://raspberrytips.com/access-point-setup-raspberry-pi/

I can plug this into any Hub and I can log onto this WAP.

see "Setting up a Routed Wireless Access Point" on

https://www.raspberrypi.org/documentation/configuration/wireless/access-point-routed.md - now for bookworm

The diagram below is copied from the Raspberry Pi web page. My IP addresses are 192.168.1.x instead of 10.10.0.x :-

                                          +- RPi -------+
                                      +---+ 10.10.0.2   |          +- Laptop ----+
                                      |   |     WLAN AP +-)))  (((-+ WLAN Client |
                                      |   | 192.168.4.1 |          | 192.168.4.2 |
                                      |   +-------------+          +-------------+
                  +- Router ----+     |
                  | Firewall    |     |   +- PC#2 ------+
 (Internet)---WAN-+ DHCP server +-LAN-+---+ 10.10.0.3   |
                  |   10.10.0.1 |     |   +-------------+
                  +-------------+     |
                                      |   +- PC#1 ------+
                                      +---+ 10.10.0.4   |
                                          +-------------+

I added netstat-nat and iptstate to the Raspberry Pi to list the NAT connections.

https://www.cyberciti.biz/faq/display-iptables-router-nat-connections-using-netstat-nat/

https://tweegy.nl/projects/netstat-nat/

iptstate in real time:- https://www.phildev.net/iptstate/

I tried Wireshark but it was very confusing. There seemed to be a very large number of IP addresses being used.

I built this on a microSD for a Raspberry Pi 3 and on a fresh install of Raspberry Pi Desktop. https://www.raspberrypi.org/software/raspberry-pi-desktop/

I can use this to filter the connections I am interested in:

 date && sudo netstat-nat  -n | grep "62.239"

sudo cat /proc/net/nf_conntrack

It is also possible to use this command:

 sudo cat /proc/net/nf_conntrack | grep "62."

date && sudo cat /proc/net/nf_conntrack | grep "62."

I filter and can see it has connected to port 80 at "192.168.1.254" , which possibly is the hub's gateway config web server.

 pi@raspberrypi:/ $ sudo cat /proc/net/nf_conntrack | grep "192.168.1.254"
 ipv4     2 tcp      6 88 TIME_WAIT src=192.168.4.5 dst=192.168.1.254 sport=53647 dport=80 src=192.168.1.254 dst=192.168.1.86 sport=80 dport=53647 [ASSURED] mark=0 zone=0 use=2

https://stackoverflow.com/questions/16034698/details-of-proc-net-ip-conntrack-and-proc-net-nf-conntrack has some comments

Another way of doing this may be to set up a Wap using https://openwrt.org/

They have a page: https://openwrt.org/docs/guide-user/network/wifi/routedap

I need to set up static ip address and dns on the smartphone as I am struggling to get the DHCP and DNS to work.