Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make default gateway IP '.1' instead of '.254' #175

Merged
merged 6 commits into from
Apr 11, 2024
Merged

Conversation

emtuls
Copy link
Member

@emtuls emtuls commented Mar 13, 2024

Having the default gateway be set to the common default IP address of the Virtual Adapter (.1) fixes an issue where FakeNet expects to be able to reach out of the guest via the DHCP server which it assumes is at .254.

The DHCP server is only at .254 if using VMware and the last address in the IP pool for DHCP is .254, which is fairly common, but this is not the case on VirtualBox. VirtualBox uses 1 IP address less than the lowest address in the IP pool for DHCP and thus, FakeNet does not work out of the box for VirtualBox.

If we instead use the IP Address of the Virtual Adapter created by VMware and VirtualBox, which is typically the .1 address, we can make FakeNet work out of the box for both of these platforms.

Context wise, this is for a Host-Only network for a guest VM where DHCP is enabled.

Copy link

@stevemk14ebr stevemk14ebr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Tested this with Elliot last week, great work identifying the fix!

@thejoelpatrol
Copy link

thejoelpatrol commented Mar 25, 2024

It has been a while since I have tried it, but last time I used VirtualBox, .1 did not work for the gateway with the current version of FakeNet at that time.

I filed an issue about it but then went back to using VMWare: #168
If this is resolved since then, we can close that.

@emtuls
Copy link
Member Author

emtuls commented Mar 25, 2024

@thejoelpatrol That is interesting...
I have never hit the issue of FakeNet not being able to set the Gateway like that. And for the .100 case, I suspect that is the DHCP server address that your adapter is being set to use, if you were to check in the VirtualBox Network Settings.
.1 seems to work for myself and @stevemk14ebr when we tested.

In all of my testing, FakeNet always sets the Gateway to .254 which FakeNet uses as a default and can be seen here:

gw_address = ip_address[:ip_address.rfind('.')] + '.254'

And that of course fails in VirtualBox due to it not being the DHCP server (at least not by default) or the Virtual Adapter address (which is typically .1).

Here is that default on version 1.4.11 (most of my testing was on version 3.0-alpha) where it tries .254 and everything fails:
image

And here is the change to .1 with the pings working (along with testing things like google.com):
image

Also, here it is with the change to .1, but instead of setting manually through the GUI, I tried with the same command you used to see if that made a difference:
image

I am on VirtualBox 7.0.14r161095, Virtualbox Guest Additions: 7.0.14

@thejoelpatrol
Copy link

@emtuls thanks for all that testing. I can't explain why it didn't work for me at that time, I didn't dig into the FakeNet code to try to understand it fully beyond just figuring out how to reproduce it locally. I hope it was something specific to my setup that was uncommon. But just something to be aware of, in case it's one of those bugs that goes away by itself and then comes back by itself.

@emtuls emtuls force-pushed the master branch 4 times, most recently from eb5fe2b to 492f7b9 Compare April 3, 2024 19:48
* Use .1 for default gateway instead of .254
Update documentation to use new year
Update documentation links to current working links
Update documentation to use Mandiant instead of FireEye
@tinajohnson
Copy link
Contributor

Thanks for the PR, @emtuls! Tested from my end as well and the fix works smoothly.

Copy link
Collaborator

@strictlymike strictlymike left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved for pre-release

@tinajn tinajn merged commit 2e3e99e into mandiant:master Apr 11, 2024
1 check passed
emtuls added a commit to emtuls/flare-fakenet-ng that referenced this pull request May 22, 2024
* Make default gateway IP '.1' instead of '.254'

* Use .1 for default gateway instead of .254

* Updates to documentation:
Update documentation to use new year
Update documentation links to current working links
Update documentation to use Mandiant instead of FireEye

* Fix filepath of HTML report template

* Minor code cleanup

* Update CHANGELOG

---------

Co-authored-by: Tina Johnson <[email protected]>
emtuls added a commit to emtuls/flare-fakenet-ng that referenced this pull request May 22, 2024
* Make default gateway IP '.1' instead of '.254'

* Use .1 for default gateway instead of .254

* Updates to documentation:
Update documentation to use new year
Update documentation links to current working links
Update documentation to use Mandiant instead of FireEye

* Fix filepath of HTML report template

* Minor code cleanup

* Update CHANGELOG

---------

Co-authored-by: Tina Johnson <[email protected]>
emtuls added a commit to emtuls/flare-fakenet-ng that referenced this pull request May 23, 2024
* Make default gateway IP '.1' instead of '.254'

* Use .1 for default gateway instead of .254

* Updates to documentation:
Update documentation to use new year
Update documentation links to current working links
Update documentation to use Mandiant instead of FireEye

* Fix filepath of HTML report template

* Minor code cleanup

* Update CHANGELOG

---------

Co-authored-by: Tina Johnson <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants