Tcp syn-proxy, PF, NAT connections

M

Magnesik

Is there possible to use PF's tcp syn-proxy for outgoing NATed connections? If it is possible, will it protect against passive fingerprinting?
 
Here some advices for hiding your system: http://zog.net/Docs/nmap.html

As far as I concerned pf synproxy works for incoming connections, handling handshake between endpoints, so I think you can use it before address translation occurs. But it's not enough to hide your system from popular scanners.
There's a lot of protecting measures available in pf and FreeBSD. You can block outgoing replies (TCP RST, ICMP port unreachable) from closed ports and use pf os fingerprints. See pf.conf(5)
 
Yes, you have right but I think only about passive fingerprinting, not active. I was wondering if syn-proxy would protect before guess number of machines behind NAT.
 
Scrub is not good enough. As I know scrub doesn't do anything with window size. Various OSes use other default value of window size and this parametr helps in guess number of machines behind NAT. I thought that syn-proxy would be helpfull.
 
I have tried synproxy state for nat connections and I observed one curious thing.

At first I'll show what I have done.

[Internet] --- rl0(serwer)rl1 --- [Lan]

I wanted to hide characteristic parts of syn outgoing packets. I used synproxy state for it in pf (ports are only examples):

Code: 
pass in on rl1 proto tcp from any to any port {443, 8080} flags S/SA synproxy state

Everything works fine. Every outgoing nated syn packet looks the same but they don't look like system's syn packets. Here is listing from p0f:

Code: 
10.0.0.101:62346 - UNKNOWN [0:128:1:44:M1460:.:?:?] [high throughput] -> 91.111.11.11:443 (link: ethernet/modem) ##synproxy state###

10.0.0.101:57584 - UNKNOWN [65535:128:1:48:M1460,S,E:P:?:?] -> 193.11.11.11:80 (link: ethernet/modem) ##system syn##

As we can see they are diffrent. Besides why does synproxy's syn have 0 windowsize?! and why in general these both packets are diffrent?
 
You must log in or register to reply here.
Back
Top