I LOVE middleboxes. They allow you to do alot with machine you either can't or don't want to reconfigure. I even used a very simple middlebox to fix an issue where there were two machines with the same mac address while working helpdesk. I usually use them to connect other machines to some kind of overlay network but they can be used for a bunch of different things. Some legitimate uses:
Forward Proxy
Firewall
Inline IDS
Getting devices that can't usually join a vpn/overlay network on that vpn/overlay network (mostly to play multiplayer on a cracked switch)
It can also be used for illegitimate uses:
Network Implant
mitm
tcp reflection (ddos)
What our middlebox should do
I want to build a network implant so this middlebox should be transparent to both the host and the network and should also allow us remote access into the network and have a bunch of tools on the box itself. Theres a couple things we need to do for this to work:
Needs to have the same IP and Mac as the host but needs some king of filter so packets that are supposed to go to the host get forwarded and packets that are supposed to go to the middle box don't get forwarded.
Possible ttl mangling to match the host
If not running kali it needs the tools installed manually
It needs to be able to handle an 802.1x connection
mitm would be nice, it's a bit difficult to do with https (squid sslbump peak and splice might help here I need to look into it more)