Note:
As the category suggest this is nearly a hack/fun/for testing only.

Per my quest to use ClearOS on a device with a single nic, I thought to my self, why not try clearos with arpspoofing. It is usually used for MITM attacks, but it essentially spoofs the gateway passing all traffic through the device hosting the aprsoof. So in theory you could use a device with one nic +arpspoof+ clear os for gateway services right? Everyone who Ive talk to say no, you can't but they have no reason/proof that it won't work. If you know WHY this won't work, please let me know and I will rest my quest.

The theory around this test is, arpspoof should be working on layer 2 and man in the middle software that is used if not a simple tcpdump works off layer 7, correct. So all if setup correctly, all traffic headed to gateway 192.168.1.254 should go through 192.168.1.154, then off to 192.168.1.254, in which ClearOS gateway services should work.

I have created and tested arpsoof via terminal on ClearOS device. I had to launch three terminals. I used tcpdump and confirmed that if I go to google.com from 192.168.1.100 then it goes through 192.168.1.154(Thinking its gateway), then off to 192.168.1.254(gateway to internet) and vice versa. This setup works.

However if ClearOS as standlone , setup gateways services such as Content Filtering, and blocked google.com IP while the arpsoof is setup via clearOS terminal, content filtering does not block google.com on 192.168.1.100, even through tcpdump see the traffic from 192.168.1.100 to .154 to .254 and vice versa. Could this be a ClearOS Configuration?

Here are my questions.

1.) To use gateway services in ClearOS does the config need to be setup for gateway?
2.) Are there technical documents that share the difference of standalone vs gateway?

Any suggestions? I'll update once I find/test other possible resolutions.

Thanks!