MAC Address Spoofing

stephenw10

Right, then you need to assign/enable the parent interface and spoof the MAC there. You don't have to set an IP on the parent though, you leave it set to 'none'.

Steve

JollyCloudyCheergoose

@stephenw10 Do you know where I can find documentation on how to do this?

If I'm using the pfSense firewall now, does that mean that my ISP already saw my real MAC address and whatever spoof I did in the Setup Wizard failed?

stephenw10

I'm not sure that's detailed anywhere specifically. But it is simple as assigning and enabling the parent interface and setting a MAC there.
The ISP would be able to see the parent interface MAC address if they are looking for it. But since it's a PPPoE connection they probably don't care.

Steve

JollyCloudyCheergoose

@stephenw10 I am really struggling to even find the parent interface tab on the pfSense GUI or netgate documentation.

Jarhead

@jollycloudycheergoose Go to interfaces/assignments.
On the bottom there's a drop down with any available interfaces. Find yours, then click add.

JollyCloudyCheergoose

@jarhead Yes there's the interfaces in the list that I have currently. And I can add one of the other igb ports. If I add this port it is the "parent"? I am confused by the parent concept

Jarhead

@jollycloudycheergoose Post a screenshot of your WAN settings and your interface assignments page.

JollyCloudyCheergoose

@jarhead

For security purposes, login credentials/passwords are redacted. Thank-you

Jarhead

@jollycloudycheergoose Click the green Add button. Then reread the previous instructions above.

stephenw10

To be clear the pppoe0 interface is running on igb0 as shown. So assign and enable igb0 and set the MAC there.

Steve

JollyCloudyCheergoose

@stephenw10 On this second “Parent“ Interface, I set the IPv4 Configuration to None or DHCP?

I tried using a second router I control as a fake ISP just to test it, by plugging the pfSense’s WAN into my test router.

If the pfSense parent interface is set to DHCP, then it shows up on my test router with the correct MAC! But then the internet doesn’t work when plugged into the Real PpoE ISP.

But if I do the pfSense Parent set to None, then it doesn’t show up on my test router. So how do I know if the PpoE ISP is seeing my bullshit MAC?

stephenw10

If you run a pcap on the NIC you will see the PPPoE encapsulated traffic like:

16:21:10.098291 00:0d:b4:0c:ae:d6 > 20:e0:9c:df:c3:7b, ethertype PPPoE S (0x8864), length 51: PPPoE  [ses 0xb19] IP (0x0021), length 31: (tos 0x0, ttl 64, id 22510, offset 0, flags [none], proto ICMP (1), length 29)
    146.x.x.x > 8.8.8.8: ICMP echo request, id 48664, seq 54376, length 9
16:21:10.104389 20:e0:9c:df:c3:7b > 00:0d:b4:0c:ae:d6, ethertype PPPoE S (0x8864), length 60: PPPoE  [ses 0xb19] IP (0x0021), length 31: (tos 0x60, ttl 118, id 0, offset 0, flags [none], proto ICMP (1), length 29)
    8.8.8.8 > 146.x.x.x: ICMP echo reply, id 48664, seq 54376, length 9

The MAC is required for layer 2 to work. Your ISP could see it if they cared.

You can leave the assigned parent interface set as IPv4 NIC type 'none'. Or, if you assign it an IP in the same subnet as the modem you can use that to access the modem if needed.

Steve

JollyCloudyCheergoose

@stephenw10 To run the pcap on the NIC, you are using Wireshark?

Also if I go under:
Interfaces → Assignments → Interface Assignments
It lists the MAC address of all interfaces but my spoof isn't there, while it is appearing in the text box of editing that individual interface

stephenw10

I used the pfSense webgui for that in Diag > Packet Capture.

You should see the spoofed MAC address in Status > Interfaces if it has been applied. You can also see it in the output of ifconfig like:

[2.7.0-DEVELOPMENT][admin@cedev.stevew.lan]/root: ifconfig em0
em0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
	description: webserver
	options=81209b<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,VLAN_HWCSUM,WOL_MAGIC,VLAN_HWFILTER>
	ether 00:11:22:33:44:55
	hwaddr d2:43:8f:91:74:e7
	inet6 fe80::211:22ff:fe33:4455%em0 prefixlen 64 scopeid 0x1
	inet 172.25.10.1 netmask 0xffffff00 broadcast 172.25.10.255
	media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
	nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>

Steve

JollyCloudyCheergoose

@stephenw10 Okay on ifcongig it is showing up. And now it's showing up in the Interface Assignments as well. So you helped me and fixed the problem! Thank-you so much

Under Diagnostic -> Packet Capture, it doesn't show me any MACs tho, just IP addresses

stephenw10

You have to set the Level of Detail higher to see MACs displayed. Note that doesn't change what is actually captured, only what the pfSense GUI shows you.

Steve