[gentoo-security] RE: port knocking

[gentoo-security] RE: port knocking

[morgan allen]

Here is a method I use to frustrate people trying to
nab my wifi connection using iptables (wireless router
-> linux router -> dsl -> net). The wireless router in
setup with a basic NAT for my desktops and wireless
but the wireless comes in on its own nic. with
prerouting set to drop, I have
[1:56] -A PREROUTING -m ttl --ttl-eq 202 -j ACCEPT

echo 204 > /proc/sys/net/ipv4/ip_default_ttl
on my laptop init

-- 
gentoo-security@gentoo.org mailing list

Re: [gentoo-security] RE: port knocking

[boger]

Hello morgan,

Wednesday, October 5, 2005, 12:12:53 AM, you wrote:

ma> Here is a method I use to frustrate people trying to
ma> nab my wifi connection using iptables (wireless router
->> linux router -> dsl -> net). The wireless router in
ma> setup with a basic NAT for my desktops and wireless
ma> but the wireless comes in on its own nic. with
ma> prerouting set to drop, I have
ma> [1:56] -A PREROUTING -m ttl --ttl-eq 202 -j ACCEPT

echo 204 >> /proc/sys/net/ipv4/ip_default_ttl
ma> on my laptop init

Correct me if I wrong, but it works only from lan, because ttl decreases when routed.
 
Also it needs root or special user to change /proc/sys/...
 

-- 
Best regards,
 boger                            mailto:boger@ttk.ru

-- 
gentoo-security@gentoo.org mailing list

Re: [gentoo-security] RE: port knocking

[Dan Gregory]

morgan allen wrote:

>  -A PREROUTING -m ttl --ttl-eq 202 -j ACCEPT
> 
> echo 204 > /proc/sys/net/ipv4/ip_default_ttl

202 != 204?

Is this a typo?

Dan
-- 
gentoo-security@gentoo.org mailing list

[gentoo-security] RE: port knocking

[morgan allen]

Yes I have it setup to work only from lan side, but i
can work from the net side by tracerouting first, then
setting the ittl accordingly. And yes, unfortunatly it
does require special privleges.
-- 
gentoo-security@gentoo.org mailing list

[gentoo-security] RE: port knocking

[morgan allen]

nope, laptop -> wifi router -> iptable
-- 
gentoo-security@gentoo.org mailing list

Re: [gentoo-security] RE: port knocking

[Willie Wong]

On Tue, Oct 04, 2005 at 04:31:38PM -0400, Dan Gregory wrote:
> >  -A PREROUTING -m ttl --ttl-eq 202 -j ACCEPT
> > 
> > echo 204 > /proc/sys/net/ipv4/ip_default_ttl
> 
> 202 != 204?
> 
> Is this a typo?
> 
Thought so first, but remember that each time a router touches it the
ttl gets decreased. So if the linux routing box it two hops away from
the laptop (which is likely if he has a separate wireless router
dedicated to such use) the difference of two would be the right
solution. :)

W
-- 
"What the hell, he thought, you're only young once, and 
threw himself out of the window. That would at least keep 
the element of surprise on his side." 

- Ford outwitting a Vogon with a rocket launcher by going 
into another certain death situation. 
Sortir en Pantoufles: up 54 days, 58 min
-- 
gentoo-security@gentoo.org mailing list