4 ms·

You might be interested in https://samy.pl/pwnat/ https://samy.pl/pwnat/ Specifically, when the server starts up, it begins sending fixed ICMP echo req

You might be interested in https://samy.pl/pwnat/ https://samy.pl/pwnat/ Specifically, when the server starts up, it begins sending fixed ICMP echo request packets to the fixed address 3.3.3.3. We expect that these packets won't be returned. Now, 3.3.3.3 is *not* a host we have any access to, nor will we end up spoofing it. Instead, when a client wants to connect, the client (which knows the server IP address) sends an ICMP Time Exceeded packet to the server. The ICMP packet includes the "original" fixed packet that the server was sending to 3.3.3.3. The packet is INSIDE the computer. This harcoded packet is built into pwnat and acts as an identifier for pwnat. Why? Well, the client is pretending to be a hop on the Internet, politely telling the server that its original "ICMP echo request" packet couldn't be delivered. Your NAT, being the gapingly open device it is, is nice enough to notice that the packet *inside* the ICMP time exceeded packet matches the packet the server sent out. Your NAT then forwards the ICMP time exceeded back to the server behind the NAT, *including* the full IP header from the client, thus allowing the server to know what the client IP address is!

tambourine_man 3y ago
pwnat seems really interesting and potentially easier than my SSH tunnels. Thanks for the link
hddqsb 3y ago
To save others some reading: This trick (ping 3.3.3.3) is used to let a server behind NAT learn the IP address of a client that is also behind NAT, without requiring any non-NAT server (such as https://ifconfig.co https://ifconfig.co). The main action of this tool is to then create a UDP tunnel between the client and server. But based on quick reading, the tool appears to assume that the NAT does not rewrite the UDP source port, so it won't work on all routers. STUN (which is used in e.g. WebRTC) implements more sophisticated techniques, and even then there are some cases where it cannot work and the only option is to use a relay (TURN). I'm pretty sure that the same issue applies to the ping 3.3.3.3 trick -- if the NAT rewrites the ping identifier (as described in the article), the trick would break.

tambourine_man 3y ago

pwnat seems really interesting and potentially easier than my SSH tunnels. Thanks for the link

hddqsb 3y ago

To save others some reading: This trick (ping 3.3.3.3) is used to let a server behind NAT learn the IP address of a client that is also behind NAT, without requiring any non-NAT server (such as https://ifconfig.co https://ifconfig.co). The main action of this tool is to then create a UDP tunnel between the client and server. But based on quick reading, the tool appears to assume that the NAT does not rewrite the UDP source port, so it won't work on all routers. STUN (which is used in e.g. WebRTC) implements more sophisticated techniques, and even then there are some cases where it cannot work and the only option is to use a relay (TURN). I'm pretty sure that the same issue applies to the ping 3.3.3.3 trick -- if the NAT rewrites the ping identifier (as described in the article), the trick would break.